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Foreword 


Over a span of 20 years, the vision of an international orbiting outpost—one with continuous human presence, measuring 
the size of a football field, with mass of -900,000 lbm, and orbiting the Earth every 90 minutes—became a reality. The 
International Space Station (ISS) is a testament to what engineering miracles can be accomplished with vision, leadership, 
perseverance, political support, and funding. The ISS enables world-class scientific research, forges pathfinders for future 
exploration travel, and unites 15 international partners working together with common goals to keep the ISS viable. 


We are grateful for the visionaries who planted the seeds of continuous human presence in space, beginning with science 
fiction books and movies that stretched the limits of our imagination. These futuristic dreams inspired technologies 
required to support civilian spaceflight and military endeavors that, over time, have not only turned out to be possible but 
are now part of our everyday life. 

The ISS is part of NASA’s ongoing, deliberate, step-by-step approach for expanding the boundaries associated with 
human spaceflight exploration that will return us to the moon and eventually to inhabiting Mars. The ISS Program stands 
proudly on the shoulders of giants who accomplished increasingly complex and ambitious space projects. The early 
Mercury rockets demonstrated our ability to safely leave Earth’s atmosphere with human passengers, followed by the 
Gemini and Apollo projects, which were pathfinders for spacewalks, rendezvous, dockings, and human moon landings. 
The Skylab and Mir space stations, along with the Apollo/Soyuz program, established collaborations with international 
partners and demonstrated that we could safely operate long-term in low-Earth orbit. A winged Space Shuttle, with 
the capability to achieve low-Earth orbit for extended periods, enabled astronauts to conduct scientific research and to 
deploy, retrieve, and repair payloads and satellites. All of these experiences culminated with the adventure of assembling 
the ISS in low-Earth orbit, testing the ability of engineers, operators, astronauts, scientists, and numerous others working 
as a team with common goals. 


Beginning in 1998, the ISS evolved from two modules—one Russian and one American—into a complex composed 
of 14 elements operated by 15 countries that provides a continuously operating laboratory expanding the scientific 
boundaries of both physical and biological sciences. The ISS creates a stable platform for studying the effects of long¬ 
term human presence for life support, propulsion, electrical, and structural systems to allow humans to explore further. 
This will lead to technologies and operational techniques for longer-duration spaceflights, a deep space outpost, a 
permanent base on the moon, and eventually a human outpost on Mars. 

The flight directors involved in the planning and assembly of the ISS played a vital leadership role in planning, training, 
orchestrating, and executing each mission. Of the current 91 flight directors in NASA human spaceflight history, more 
than half of them have worked directly with planning and assembly of the ISS. This Flight Operations leadership and 
dedication helped to pave the way for the tactical real-time assembly of an operationally evolving spacecraft, knitting 
together individuals and teams from astronauts to design engineers who were all oriented toward the same strategic goal. 

We would be remiss to not mention that the ISS would never have become a reality without the ISS Program and 
Space Shuttle Program leadership providing the overarching vision, funding, and integration with the international and 
commercial partners. Countless individuals and teams support these programs in critical roles and have dedicated their 
lives to developing, assembling, and now keeping the ISS a reality. 


As we embark on new initiatives requiring human presence farther into the solar system, the Flight Operations team 
will carry with it the legacy of operational experience necessary to continue turning dreams into reality, all in support of 
NASA’s exploration goals. 




Patrick Forrester 

Chief Astronaut, Flight Operations 


Brian Keiiy 

Hrector, Flight Operations 



Norman Knight 

Chief Flight Director, Flight Operations 
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Preface 

Throughout my childhood, I was blown away, and inspired, by the amazing feats that NASA was accomplishing: 
walking on the moon; sending probes to Venus, Mars, Jupiter, and Saturn; flying a reusable Space Shuttle; and 
building space stations. Twenty years ago, I got the privilege of joining the NASA team, in particular in the famed and 
historic Mission Control. I realized early on that success was not built on technological marvels but on the shoulders 
of the men and women who worked at NASA. It was the men and women who laid awake at night and worried about 
what could possibly go wrong. It was the men and women who put all their passion into making sure the systems and 
the procedures, often challenged by tight budgets or a changing political climate, met the mission objectives. These 
engineers and scientists work in numerous directorates in various cities across the country to support the International 
Space Station Program. The Program office then turns to the Flight Operations Directorate to operate the space station. 
When the mission is occurring, it is the people in Mission Control who are on the front line to protect the lives of our 
astronauts, also members of our team, while ensuring mission success. We spend much of our time in consultation 
with the engineers, trying to anticipate problems in advance so that we are prepared for any eventuality. But when 
a problem occurs, things become truly extraordinary. That is when the people of NASA—all of NASA—put aside 
personal commitments and differences, roll up their sleeves, and work together nonstop until the issue is resolved. In 
fact, the passion of these people makes the job look so easy. The general public does not have a full understanding 
of what is involved in either the successful missions or those hit with a serious malfunction. That is why we chose to 
write this book. We want the reader to get a glimpse into what we do in our daily lives in Mission Control. 

This is an unusual book. Half the chapters are devoted to operations, meaning what we do in real time during a 
mission. For the International Space Station, real time is continuous 365 days a year, 24 hours a day. These chapters 
will describe different operational aspects of “flight control.” However to get the full context, the remaining chapters 
will provide technical descriptions of the primary space station systems. Although not strictly required to understand 
the operations, they are intended to provide more information for proper context. Hopefully, these chapters are not too 
dense for the reader. 

A complete list of specific people to acknowledge, of which there are many, is in the back of this book. However, 
this project would not have been possible without the help, support, and full backing of the directors of the Flight 
Operations Directorate at Johnson Space Center, Paul Hill and Brian Kelly. Ginger Kerrick was also key in helping 
to find the financial support to back the director’s support. I must also thank my wife, Dorothea Lerman, who literally 
helped birth the book and provided early editing and feedback. Finally, we must acknowledge all the men and women 
who have worked in Mission Control from the first flight director, Christopher Kraft, to today. Literally everything we 
do today is based on lessons they learned and techniques they developed. 


/CAjt 


(■ Robert C. Dempsey / 

Flight Director, Flight Operations 
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Introduction 

Mission Control 

The International Space Station 
(ISS) — two-time nominee for the 
Nobel Peace Prize, and winner of 
the 2009 Collier Trophy—is a space 
outpost that is unfamiliar to many 
people . Behind this amazing feat 
of engineering is not just science 
and math but a team of devoted 
men and women from around the 
world and many walks of life that 
have made the ISS a success. These 
professionals comprise the Flight 
Control Team (FCT) of Flight 
Operations. This FCT is the Houston 


in such famous phrases as “Houston, 
Tranquility base here. The Eagle has 
landed,” and “Houston, we’ve had 
a problem.” Although astronauts 
are the visible front of the space 
program, the FCT works around 
the clock to ensure the health of 
the crew and the smooth operation 
of the vehicle. Many a controller 
has worked on Christmas, canceled 
a holiday, or lain awake at night 
worrying about failures or wondering 
what might have been missed before 
a mission. This passion and attention 
to detail has allowed the ISS and the 
programs that preceded it—Space 
Shuttle, Skylab, and Apollo—to 
succeed. These are the people who 
step up when things do not go well. 


But, as with the hidden magic of a 
stage crew on a theatre production, 
the FCT is rarely seen or heard. 

Most people’s exposure to the 
controllers is limited to what they 
see on NASA television: a serene¬ 
looking room full of men and 
women sitting in front of computer 
consoles, showing little difference 
between when the crew is asleep 
and when a major malfunction has 
occurred that threatens the crew, 
vehicle, or success of a mission. 

One way to tell things are not going 
as planned is when a collection of 
flight controllers, and potentially 
managers, huddle around the console 
of the flight director—i.e., the person 
responsible for keeping the whole 



The completed International Space Station with the Space Shuttle Endeavour on one end and the European Automated Transfer Vehicle on the other, as seen 
from the Russian Soyuz vehicle on May 23, 2011. 









mission proceeding along. This 
perspective provides little insight 
into what a controller or the flight 
director actually does while “on 
console.” Only when the movie 
Apollo 13 —a film starring Tom 
Hanks as Jim Lovell, and one 
that NASA shows its newest team 
members as part of their training— 
was fresh in people’s minds could 
NASA point to something and say 
to the general public, “See, that is 
what we do.” 

For the control room to appear so 
serene, a great deal of work (some 
of it admittedly boring) has preceded 
those efforts. The flight director is 
always there and takes the operational 
lead—from training each controller 
to training the crew, while overseeing 
the implementation of the plan, 
developing procedures, writing rules 
to guide the mission as directed by the 
ISS Program, and coordinating with 
the Engineering team. This includes 
the training team itself; i.e., the 
clever, if not diabolical, people who 
try to find the potholes in the mission 
and, more importantly, come up with 
failure scenarios that, even if not 
probable, get the team thinking about 
how to deal with the unexpected. In 
fact, this sort of training had prepared 
the team to think about using the 
lunar module as a lifeboat during the 
Apollo 13 mission. 

This book will discuss how the 
flight directors and their teams make 
it all happen. With a foundation 
built during Project Mercury, the 
focus will be on the ISS and the 
unique challenges that the project 
has presented over its many years. 
Various aspects of operations— 



The sigma (2) represents the total mission team, including flight controllers, instructors, 
flight design, mission planning and production specialists, facility development and 
support teams. The launch vector and plume represent the dynamic elements of 
space, the initial escape from our environment, and the thrust to explore the universe. 


The orbiting star symbolizes a permanent human presence in space, conducting 
research, developing materials and leading the expanding utilization of the 
space environment. A single star is positioned over Houston, the home of the 
United States human spaceflight operations. At the top of the emblem, the Moon 
and Mars represent NASA’s mission to lead the nation’s permanent journey out 
of low Earth orbit. 


The Mercury, Gemini, Apollo, Skylab, Shuttle and ISS programs are represented in 
the legacy ring on the bottom border, commemorating programs for which we have 
operated in space. On the upper border is the wording “Res Gesta Per Excellentiam” — 
“Achieve through Excellence” — which is the standard for our work. It represents an 
individual’s commitment to a belief, to craftsmanship, and to perseverance, qualities 
required to continue the exploration of space and the quest for the stars. 


The white stars in the background represent the four original principles of the Mission 
Operations team: discipline, morale, toughness, and competence. 


The comet represents those individuals who have given their lives for space exploration, 
while the seventeen blue stars represent our fallen astronauts, to whom the flight 
controllers dedicate their commitment to excellence. These symbols serve as a 
reminder of the real human cost and risks inherent to space flight and the ultimate 
responsibility the Mission Operations team bears in facing those risks. 


This emblem was originally developed during the Apollo program to recognize 
the mission control team’s unique contribution to manned space flight since the 
Mercury program. 


Figure 1 . The current Flight Operations Directorate emblem with an explanation as to its meaning. 



from training, to planning a mission, 
to executing a spacewalk or, as 
happens, responding to a failure— 
are discussed in these chapters. 
Several chapters also describe the 
technical aspects of the systems 
to help the reader understand the 
challenges faced by the flight director 
and his or her team. 

The FCT has always consisted of 
highly dedicated and proud people, 
from NASA’s first flight director, 
Christopher Kraft Jr. and his team, 
Apollo 13 Flight Director Gene 
Kranz, and Shuttle Flight Director 


Milt Heflin, to the people who sit 
in Mission Control today. Books 
by Kraft (2001), Kranz (2000), and 
Houston and Heflin (2015) provide 
additional details on the early days 
of flight control from the beginning 
of NASA through the Space Shuttle 
era. Those men created the Houston 
FCT, making it up as they went but 
continually learning to make things 
better as ever-more-challenging 
and complicated missions were 
performed. Two important items that 
every flight controller holds dear— 
the mission patch and the foundations 
of flight control—were developed 


in the early days and, as with flight 
control itself, have adapted over the 
years. These two symbols reflect the 
pride and philosophy that has shaped 
the teams over the past 50-plus years. 

As with the individual teams, mission 
operations has its own patch, which 
is rich in symbolism and history. As 
operations changed, so did the patch. 
In 2014, the Flight Crew Operations 
Directorate and Missions Operations 
Directorate were merged into the 
Flight Operations Directorate. 

Figures 1 and 2 show the current 
patch, its meaning, and its evolution. 



Figure 2. As with the FCT, which has proven to be flexible and adaptable over time, the operations patch has also evolved over the years. Artist Robert T. 
McCall designed the initial patch in 1973. The Saturn 1 / rocket was moved to the background and a shuttle launch was added to the center of the patch when 
that program began. In 2004, Mike Okuda updated the emblem to include the ISS Program, and the number of stars was increased to 17 to represent the 
US astronauts whose lives were lost. Program symbols were made more generic to reflect the ever-growing family of crewed missions. When the Astronaut 
Office merged with the Flight Operations Directorate in 2014, elements of the astronaut logo (i.e., the three contrails with a circle) were incorporated. 

Top row, left to right: 1973, 1983, 1988. Second row, left to right: 2004, 2012, 2014. 
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The foundations of flight control 
were born out of the ashes of failure. 
Shortly after the Apollo 1 fire in 1967 
that killed three astronauts on the 
launch pad, Flight Director Gene 
Kranz told his team that henceforth 
they would need to be “tough” 
and “competent” to ensure such an 
accident would not happen again. 

“From this day forward, Flight 
Control will be known by two words: 
‘Tough ’ and ‘Competent. ’ Tough 
means we are forever accountable 
for what we do or what we fail to do. 
We will never again compromise our 
responsibilities. Every time we walk 
into Mission Control we will know 
what we stand for, 

“Competent means we will never 
take anything for granted. We 
will never be found short in our 
knowledge and in our skills. Mission 
Control will be perfect. ” 

Gene Kranz (2000) 

Out of this grew what is called the 
Foundations of Mission Control. 

The majority of flight controllers 
have this on their wall or desk, 
or have committed it to memory. 
This is the creed to which the team 
literally lives by every second of 
the day. The current version is 
shown below. This “tough” and 
“competent” stance was exhibited 
during the Apollo 13 mission 
whenever everyone gave their 
all to save the crew, and it has 
continued. Although Kranz is not 
sure whether he ever really uttered 
“failure is not an option” during 
the mission, it applied then and 
has been the mantra repeated 
throughout the FCT ever since. 


Foundations of Flight Operations 

1. To instill within ourselves these 
qualities essential to professional 
excellence 

Discipline... Being able to follow 
as well as to lead, knowing that we 
must master ourselves before we can 
master our task. 

Competence... There being no 
substitute for total preparation and 
complete dedication, for flight will 
not tolerate the careless or indifferent. 

Confidence. . .Believing in ourselves 
as well as others, knowing that we 
must master fear and hesitation before 
we can succeed. 

Responsibility... Realizing that it 
cannot be shifted to others, for it 
belongs to each of us; we must 
answer for what we do or fail to do. 

Toughness... Taking a stand when 
we must; and to try again and again, 
even if it means following a more 
difficult path. 

Teamwork. . .Respecting and using the 
abilities of others, realizing 
that we work toward a common 
goal, for success depends upon the 
efforts of all. 

Vigilance.. .Being always attentive to 
the dangers of flight; never accepting 
success as a substitute for rigor in 
everything we do. 

2. To always be aware that, 
suddenly and unexpectedly, we 
may find ourselves in a role where 
our performance has ultimate 
consequences. 

3. To recognize that the greatest error 
is not to have tried and failed, but 
that, in the trying, we do not give it 
our best effort. 


The Foundations of Mission Control 

NASA is not unique in having a 
Mission Control. The others, either 
in another country or staffed by a 
private company, were inspired by 
the Mercury control center built 
by Kraft. These control centers share 
the same approach and mentalities, 
but with the influences of different 
cultures. Although the space station 
is international in scope, this 
book focuses on the US systems. 
High-level interfaces are discussed 
so that the reader can get a good 
understanding of the vehicle and 
operations; however, NASA defers 
to the experts among its partner 
organizations to tell their own 
story—e.g., the nice summary of 
the European Columbus module in 
Uhlig, Nitsch, and Kehr (2010), and 
the story of the Automated Transfer 
Vehicle by Castel and Novelli (2015). 
Each partner has its own control 
team, as shown in Table 1. The call 
signs are important since the flight 
directors and their teams change 
personnel throughout the day. 

The job of flight control is to ensure 
the mission goes as smoothly and 
successfully as possible. The whole 
purpose of the space station is to 
conduct research that cannot be done 
on the Earth as well as developing the 
capabilities to return to the moon and 
go to Mars. NASA’s job is to facilitate 
the research getting done, again as 
with the stage crew ensuring a theatre 
production executes smoothly. This 
means ensuring the systems are 
working properly, and minimizing 
the impact (usually in the form of 
available crew time) when systems 
encounter problems. Although not 
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Table 1. All Control Centers that Operate the ISS, or Visiting Vehicles that Support the Space Station 


Location 

Call sign 

Function 

Houston, Texas 

Mission Control Center- 
Houston (MCC-H) or 
Houston; also MCC-CST 

United States On-orbit Segment 
(USOS) or control of the Boeing 
Company’s CST-100 (Starliner) 
crewed vehicle 

Korolev, Russia 

Mission Control Center- 
Moscow (MCC-M) 
or Moscow 1 

Russian Segment 

Tsukuba, Japan 

Tsukuba 

Japanese Experiment Module 
elements and H-ll Transfer Vehicle 

Oberpfaffenhofen, 

Germany 

Munich 2 3 or Columbus 
Control Center 

European laboratory module 

Toulouse, France 

Automated Transfer 
Vehicle Control Center 
[retired from service] 

European Automated Transfer 

Vehicle cargo vehicle operations 

St. Hubert, 

Canada 

Montreal 

Remote Multipurpose Support 

Room for USOS Robotics 

Dulles, Virginia 

Mission Control Center- 
Dulles (MCC-D) 

Orbital ATK “Cygnus” cargo vehicle 

Hawthorne, 

California 

Mission Control Center- 
SpaceX (MCC-X) 

Space Exploration Technologies 
Corporation (SpaceX) “Dragon” 
crew and cargo vehicles 

Huntsville 

Huntsville 

Payloads Operations and 

Integration Center 


1 Even though the control center is located in Korolev, which was kept secret in the days of the 
Soviet Union, it is called Moscow. 

2 Although the control center is located in this small suburb of Munich, the control center is always 
referred to as Munich. 

3 The European Space Agency has various payload support centers around Europe that interface 
with Munich. 


experts in research operations, the 
FCT needs to understand what 
research is being performed, and 
how it is being performed. For 
example, if an experiment requires 
a microgravity environment as free 
from perturbations as possible, the 
operations team needs to ensure 
thrusters are not firing or that a 
visiting vehicle is not about to dock. 
The FCT works closely with the 
control centers that lead the research, 
and strives to maximize its ability to 


complete tasks. Several other books 
discuss utilization in greater detail, 
including a book by Harm & Ruttley 
(2012). If the FCT is successful, the 
ground-breaking research is all the 
public hears about, which is the case 
for other national laboratories or 
outposts such as Los Alamos National 
Laboratory or the Amundsen-Scott 
South Pole Station. 


The Road to the International 
Space Station 

A Brief History of the ISS 

Much has been written about the 
genesis of the ISS and its embryonic 
form, Space Station Freedom. 
However, the story really goes much 
further back and will not be elaborated 
on here. Considerably more detail 
can be found in such references as 
Catchpole (2008). A space station 
was always a goal early on at NASA, 
especially among the German team, 
led by Wernher von Braun, that 
came to America after World War 
II and developed NASA’s rocket 
technology. Landing on the moon 
became the priority once the Kennedy 
administration perceived it as an area 
in the space race that the US could 
win. The Soviets launched various 
space stations throughout the 1970s, 
including the first and culminating 
in the Mir complex in the 1980s. 

As soon as the moon landing was 
achieved, NASA scientists, including 
von Braun, began pushing for a space 
station. The result was Skylab—the 
first US station. Skylab was a great 
start for the US program, but it was 
literally assembled from spare parts 
out of the canceled Apollo program. 

During the 1980s, as the Space 
Shuttle Program began to take off, 
quite literally. The push again grew 
for the US to create a space station. 
President Ronald Reagan eventually 
approved Space Station Freedom 
in 1984 with an $8 billion budget; 
however, the program continued to 
fumble as the costs of the project 
escalated. The design was repeatedly 
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changed. With costs again projected 
to greatly exceed the budget, 
President Clinton ordered a rescale 
of the platform in 1993 with the 
requirement to keep the project under 
a $2.1 billion annual cap. As a result, 
NASA developed three options that 
were called, in true NASA fashion, 
options A, B, and C. Option A was 
basically a restructuring of the 
Space Station Freedom modules. 

This option had a crew of about 
five that spent 1-month intervals 
on orbit. Option B was larger and 
could allow two shuttle orbiters to 
dock simultaneously. However, it 
would only have a human presence 
during shuttle missions with the 
science payloads operating untended 
in between. Although producing a 
capable station, this option required 
a large number of launches. Finally, 
Option C was thrown together 
from “spare” parts of the Space 
Shuttle Program and Space Station 
Freedom Program, including using 
the Columbia orbiter as a permanent 
module. This would get the program 
going quickly and more cheaply, 
but it did not really support a good 
platform down the road. Option C 
was essentially a modern Skylab 
option. All three options, however, 
did call for a strong international 
cooperation, including the European 
and Japanese space programs. In fact, 
the first two options even included 
using Soyuz spacecraft for the crew’s 
emergency return vehicles. Option A 
was selected and the project was now 
called ISS Alpha. The plan called 
for the first element to be launched 
in 1997, with “assembly complete” 
status slated for 2002. 


What was the Space Shuttle? 

The term Space Transportation System referred to the entire program, 
which included the Space Shuttle, the mobile transportation launch pad, 
and even the assembly buildings. The Space Shuttle consisted of the 
external tank, which contained the liquid propellant, solid rocket boosters, 
and winged orbiter that launched like a rocket but landed like an airplane. 
The orbiter contained the crew in a pressurized area and an unpressurized 
payload bay. The fleet was composed of five orbiters, two of which 
(Challenger and Columbia) were destroyed during launch and reentry, 
respectively, resulting in the loss of 14 astronauts. Although not strictly 
correct, the terms shuttle and orbiter are used interchangeably. 


At the same time, the world was 
undergoing a marked change. In 
particular, 1991 saw the collapse of 
the Soviet Union. In late 1993, it 
was announced that Russia would 
be full partners in the ISS project. 

This decision was made as much out 
of engineering necessity as political 
reality, but it has proven to be a robust 
partnership that has enabled the ISS 
Program to be a success. However, it 
presented some interesting challenges, 
which were to be expected when 
essentially splicing together two 
different space stations. Even basic 
infrastructure such as power was 
different, as every American traveler 
has experienced when trying to plug 
an American electrical device into 
a foreign socket. Even the planned 
orbit around the Earth was adjusted 
to accommodate the Russian rockets, 
which had less lifting capability than 
the Space Shuttle. 

Because of this history, the ISS is 
separated into two segments—US 
and Russian. The United States 
On-orbit Segment (USOS) includes 


all the non-Russian partners, most 
notably the European Space Agency 
(ESA) module, the Japanese modules 
operated by Japan Aerospace 
Exploration Agency (JAXA), and the 
Canadian robotic systems operated 
jointly between NASA and the 
Canadian Space Agency (CSA). The 
remainder is the Russian Segment. 
Although different countries built 
the various modules of the USOS, 
NASA integrated them all from the 
beginning; therefore, the modules all 
have the same look and feel (e.g., use 
the same base power standard). 

The assembly sequence was laid 
out in three phases. Phase one was 
to be the learning interval. To make 
the project work, Russia and the US 
would have to learn how to cooperate 
in order to merge two very different 
programs. During this interval, US 
astronauts would spend time on 
the Russian space station Mir, and 
several cosmonauts would fly on 
the Space Shuttle. Due to the Iran 
Nonproliferation Amendments Act 
(2005), NASA could not pay for the 
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astronauts to be housed on Mir as 
Russia had done with other countries. 
The shuttle would help ferry up 
much-needed supplies in exchange 
for letting US astronauts gain station 
living experience. Simply docking 
the American orbiter to the Mir 
space station was an engineering and 
political feat in itself since neither 
the vehicles nor the programs were 
designed for such activities. Although 
automated supply ships, called 
Progress, serviced Mir, their capacity 
was nowhere near that of the shuttle. 
Seven US astronauts stayed aboard 
Mir from 1995 to 1998 for a combined 
on-orbit time of more than 30 months. 

In the second phase, the ISS would 
be constructed up to a minimal set 
of components that would make it 
a self-supporting scientific outpost. 

To help jump-start the program, the 
Russians would provide the first two 
modules that would anchor the station 
by providing living quarters, power, 
life support, propulsion (to keep 
the station from falling back to the 
Earth), and attitude control (to keep 
the vehicle in the proper orientation). 
This phase ended with the addition 
of the US airlock, which provided 
redundant extravehicular activity 
(EVA), or spacewalk, capability. 

At this point, the ISS would consist 
of living quarters, docking ports, 
propulsion and control modules, 
power-generating solar arrays, and 
airlocks that allowed for spacewalks 
that were critical for repair and 
further assembly. This would be a 
self-sufficient mini-station. 

Phase 3 would see the ISS evolve 
to “core complete.” Although more 


modules were planned beyond core 
completion (e.g., the habitation 
module), this phase represented a 
truly complete station that would 
include three science modules: 
the US laboratory, ESA Columbus 
astrophysics module, and the 
Japanese modules with an External 
Exposure Facility. Initially, the ISS 
crews consisted of three people. 

When the advanced US life support 
system was activated in 2009, the 
standard crew size increased to six. 
The ISS will be able to routinely 
support a crew of seven. It is 
anticipated the permanent crew will 
reach this number upon completion of 
the US Commercial Crew Program. 

The Program Office, located at 
Johnson Space Center in Houston, 
Texas, manages the USOS. Run by 
the program manager, the Program 
Office is responsible for all aspects of 
the program under NASA direction. 

A number of divisions under the 
program manager oversee every 
aspect of the vehicle integration and 
operations, including engineering 
support, software development, 
external integration, planning and 
safety, and mission assurance. The 
chief scientist and the ISS Research 
Integration Office are tasked with 
maximizing the research, often 
referred to as utilization, on the 
space station. Also under the ISS 
Program Office is Mission Operations 
Support. This is performed by the 
Flight Operations Directorate and the 
flight control team that executes the 
real-time operation of the vehicle. 
Note that while each international 
partner and its FCT is responsible 
for its systems, NASA is responsible 


for integration and all safety aspects 
of the space station. The Space 
Shuttle was managed out of a separate 
Space Shuttle Program Office. 

Getting to Know the International 
Space Station 

The fully assembled ISS is shown in 
Figure 3, with each element indicated. 
Although there is no true up, down, 
left, or right in space, a system is 
required to ensure everyone—crew 
and ground—are talking consistently. 
Therefore, as with a seagoing ship, 
the direction of motion is referred 
to as forward, which makes the 
opposite end the aft. In Figure 3, the 
Pressurized Mating Adapter number 
2 (PMA-2) module is at the front of 
the station and is generally the nose 
pointing in the direction of flight 
most of the time. Facing forward 
(i.e., sitting on PMA-2 and looking 
forward) means the port side is on 
the left and starboard is on the right. 
Unlike a ship on the water, the ISS 
is exposed to additional directions in 
space—i.e., up and down. When the 
ISS is orbiting forward around the 
Earth, the direction pointing down 
toward the Earth is called nadir and 
the direction away is the zenith. More 
details are provided in Chapter 8. 

Each module or segment of the 
ISS has a functional name such as 
Node 2, Laboratory, SO truss, or 
Service Module, for example. The 
FCT uses these names on all its 
operations and clearly indicates the 
function of that element. For example, 
Node indicates a pressurized module 
that serves as a hub for other modules 
to be attached. The Integrated Truss 
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Figure 3. Composite image of 
the fully assembled ISS with key 
elements noted. (Top) View from 
the front-looking aft. (Middle) View 
from below (i.e., nadir) looking up at 
the ISS. (Bottom) View from above, 
looking down on the ISS. Orientation 
of the ISS is with respect to normal 
attitude, which is discussed further 
in Chapter 8. These images were 
compiled from dozens of photographs 
taken during the fly-around of the 
Space Shuttle Endeavour after it 
undocked and flew around the ISS 
in May 2011 during one of the last 
missions to the outpost. This picture 
also shows the European Automated 
Transfer Vehicle, the Russian 
autonomous cargo vehicle Progress, 
and the Russian Soyuz spacecraft 
that transports the crew to and from 
the space station. The components 
are defined in Table 2. 
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Figure 4. Components of the ISS color coded by contributing country. 


Segment is numbered by section and 
whether it is located on the port or 
starboard side of the ISS. Thus, S4 
is the fourth truss segment on the 
starboard side, whereas P6 indicates 
the sixth element on the port side. To 
complicate matters, the P6 solar arrays 
were temporarily located on the zenith 
side of the ISS in 2000 until P6 was 
relocated to its final position in 2007. 
Additionally, the S2 and P2 truss 
segments were cut from the design 
during the transition from Space 
Station Freedom; however, the other 
truss segments were not renumbered. 
These technical names were defined 
early in the design and are found in 
every technical document used on 


the program. Later, countries named 
their pressurized modules with more 
user-friendly names, which are used 
in public discourse. For example, the 
Laboratory module is also known as 
Destiny and the European Attached 
Pressurized Module became the 
Columbus module. The technical 
names for the segments will be used 
throughout this book. 

Figure 4 shows a graphic of all the 
ISS elements and which country 
operates them. 

The ISS is the largest vehicle ever 
flown in space. Figure 5 compares the 
assembled station to a football field 
for scale. 


Assembly Sequence 

Since the ISS was too big to launch 
on any one rocket, it was constructed 
through 31 missions and, in fact, 
is still growing. The assembly 
sequence underwent many changes 
during development and execution. 
Sometimes, changes were dictated by 
delays. For example, when the next 
module was not quite ready to install, 
a logistics flight might have been 
added to take up crew supplies or 
smaller pieces of hardware. In another 
case, the launches of the Japanese and 
European modules were accelerated 
to ensure their installation on the ISS 
prior to the Space Shuttle retirement. 
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Figure 5. Size comparison of the ISS to a US football field. The following statistics provide additional information to offer a sense of scale. 

• Size: 51 m (167.3 ft) from front to back (PMA2 to Service Module) and 109 m (375.5 ft) from one tip of the truss to the other. That is equivalent 
to the length of an American football field including the end zones (a football field measures 110 m [360 ft] in length). The ISS is almost four times 
as large as the Russian space station Mir and about five times as large as Skylab, the first US space station. 

• Power Generation: Eight solar arrays on the US Segment are capable of producing a total of 84 kilowatts of solar power. The solar array wingspan 
(73 m [240 ft]) is longer than that of a Boeing 777-200/300 model, which is 65 m (212 ft). The total ISS solar array surface area is nearly 4,050 m 2 
(1 acre) in size. Thirteen km (8 miles) of wire connect the electrical power system. 

• Mass: 419,400 kg (924,700 lbs), the equivalent of more than 320 automobiles. 

• Pressurized Volume: 916 m 3 (32,333 ft 3 ), or equal to that of a Boeing 747. 

• Habitable Volume: 388 m 3 (13,696 ft 3 ), roughly the same living space as a 158 m 2 (1,700 ft 2 ) house that has 2.5 m (8 ft) walls. 


During the assembly phase, some 
missions were purely logistical 
in nature, bringing up equipment, 
supplies for the crew (e.g., food and 
water), or research payloads. Russia 
transports supplies to the ISS using 
its unmanned autonomous Progress 
vehicle. On 12 shuttle flights, the 
orbiter transported temporary 
Multi-Purpose Logistics Modules 
(MPLMs) containing approximately 
4,500 kg (-10,000 lbs) of materials. 
The MPLM would ride up in the cargo 
bay of the Space Shuttle. After the 
shuttle docked, the robotic arm would 
take the MPLM out of the cargo 
hold and berth it to the ISS where 


the astronauts could then exchange 
cargo. Before the shuttle left, the 
MPLM would be stowed in the cargo 
bay. It was later realized it would be 
of significant benefit to leave one of 
the MPLMs permanently on the ISS. 
One MPLM, nicknamed Leonardo, 
was retrofitted with additional debris 
shielding for a continuous life in 
space. Conceptually designed to act as 
a storage closet for the ISS, Leonardo 
was renamed as the Permanent 
Multipurpose Module (PMM) and 
installed on the space station in 2011. 
NASA and the international partners 
also had their own autonomous cargo 
vehicles. These included the ESA 


Automated Transfer Vehicle, the 
Japanese H-II Transfer Vehicle, and 
the American commercial vehicles 
Dragon and Cygnus. 

Later, when the ISS Program needed 
to ensure two berthing ports for cargo 
vehicles and two docking ports of the 
new US crewed vehicles, the PMM 
was moved from its position on the 
nadir side of Node 1 to the forward 
side of Node 3 in 2015. In 2016, 
the Bigelow Expandable Activity 
Module was installed on the aft side 
of the Node 3 module as part of a 
demonstration of such technologies. 
Several other modules are planned for 
the Russian Segment. 
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Each assembly mission flown by 
the Space Shuttle generally had two 
designations. First was the mission 
designation. For shuttle flights, this 
would be the Space Transportation 
System (STS) number such as 
STS-88, which indicated the 88th 
shuttle mission. Every ISS assembly 
mission would then have an assembly 
identification consisting of the 
numerical position in the planned 
sequence followed by the country of 
origin. US missions were denoted 
with an “A,” whereas “R” indicated 
Russian launches. Thus, the first 
US assembly mission is commonly 
noted as STS-88/ISS-2A, indicating 
it was the second American flight. 

One exception was the launch of 
the Functional Cargo Block, which 
was funded by the US but built, 
launched, and operated by Russia. 
This mission was designated 1 A/R, 
where the “A/R” indicates the joint 
nature of it. Sometimes, flights were 
added to the original plan. These were 
denoted by a decimal number such 
as 12A.1. When the order of flights 
were changed, as happened following 
the Columbia accident, the sequence 
was not renumbered. For example, 
flight 1OA was moved after 13A. 1. 
Table 2 lists all the assembly missions 
through 2016, plus several planned 
ones for future Russian modules. 

Note that assembly also required a 
number of EVAs. Those that occurred 
during a shuttle mission where simply 
numbered 1, 2, 3, etc. during that 
mission. Stage EVAs—those that 
occurred outside of shuttle flights— 
were numbered sequentially (1, 2, 3, 
etc.), with the prefix of R or US for 
Russian or USOS, respectively. As 
of 2017, there had been more than 


80 USOS and Russian Segment EVAs 
to assemble and maintain the space 
station. More details can be found in 
Chapters 17 through 19. 

Crews (which generally consist 
of three people) to the ISS are 
called expeditions, and are also 
known as increments. Since the 
first, Expedition 1, was launched 
to the ISS in 2000, the station has 
been continuously inhabited. The 
first crew flew to the ISS on board 
a Soyuz but came home on the 
Space Shuttle Discovery, which also 
delivered the second expedition crew 
to the ISS on STS-102/ISS-5A.1. 
During early ISS operations, most 
increment crews flew to and from 
the ISS on shuttle flights as shuttle- 
rotating expedition crew members, 
or “ShRECs.” Separate crews visited 
the ISS to rotate the Soyuz rescue 
vehicles when they reached their 
6-month on-orbit expiration date. 
After the loss of Columbia orbiter 
and her crew in 2003, Increments 
7 through 10 consisted of only two 
crew members—one Russian and 
one American—who flew to and 
from the ISS on the Russian Soyuz. 
Since then, most crew members have 
flown on the Soyuz. In 2009, the ISS 
was sufficiently mature to support 
six crew members permanently. 

Until the Commercial Crew Program 
provides crew rotation services, all 
crews rotate to and from the ISS in 
the three-crew Soyuz. The Soyuz 
stays docked at the Russian Segment 
for the duration of the expedition in 
case an emergency forces the crew to 
evacuate. Half of the expedition crew 
members are Russian cosmonauts and 
the other half are made up of NASA 
and international partner astronauts, 


whereas the position of commander 
is rotated between the cosmonauts 
and astronauts. Crews consist of 
personnel from multiple countries and 
were selected, especially in the early 
days, to ensure that there would be at 
least one American and one Russian 
on the ISS at all times. Astronauts 
from ESA, CSA, and JAXA now 
routinely fly to the outpost and have 
also served as commanders. The 
other crew members on an expedition 
are referred to as flight engineers, 
designated generically as FE 1, 

FE 2, etc. These designations are used 
so that generic planning can occur 
even prior to a crew being selected 
or if crew members are swapped for 
whatever reason. 

The ISS changed considerably, and 
sometimes dramatically, through the 
construction phase of the assembly 
process. Operational products such 
as flight rules (described below) and 
procedures executed by the crew or 
ground differed as well, depending 
on hardware and software capabilities 
or available modules that changed 
after a given shuttle assembly 
mission. Thus, the increment was 
also subdivided into stages, one 
stage beginning at the launch of a 
shuttle flight and lasting until the next 
launch. All operations products such 
as procedures referenced this stage. 

A list of all the assembly missions 
is found in Table 2. Generally, 
construction occurred by attaching 
new modules and segments of the 
truss. However, modules or structures 
sometimes had to be moved from 
a temporary position to a final 
installation location. For example, 

P6 was the first set of USOS solar 
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Table 2. Listing of all Flights Assembling the ISS 


ISS 

Assembly 

ID 

Launch Date 

Element 

Public Name, 
if applicable (English 
Translation) 

Launch 

Vehicle ID 

1A/R 

November 20, 1998 

Functional Cargo Block (FGB in Russian) 

Zarya (“Dawn” as in 
dawning, new) 

Proton 

2A 

December 4, 1998 

Node-1, PMA-1, and PMA-2 

Unity (Node-1) 

STS-88 

2A.1 

May 27, 1999 

Integrated Cargo Carrier (ICC) for supplies 


STS-96 

2A.2a 

May 19, 2000 

ICC for supplies 


STS-101 

1R 

July 12, 2000 

Service Module 

Zvezda (“Star”) 

Proton 

2A.2b 

September 8, 2000 

ICC for supplies 


STS-106 

3A 

October 11, 2000 

Z1 Truss and PMA-3 


STS-92 

4A 

November 30, 2000 

P6 Truss 


STS-97 

5A 

February 7, 2001 

US Laboratory 

Destiny 

STS-98 

5A.1 

March 8, 2001 

MPLM External Stowage Platform (ESP)-I 

Leonardo 

STS-102 

6A 

April 19, 2001 

MPLM 

Canadarm2 

Raffaello 

STS-100 

7A 

July 12, 2001 

USOS Joint Airlock 

Guest 

STS-104 

7A.1 

August 10, 2001 

MPLM 

Leonardo 

STS-105 

4R 

September 15, 2001 

RS Docking Compartment-1 (DC-1) & Airlock 

Pirs (“Pier”) 

Soyuz-U/Progress 

UF-1 

December 5, 2001 

MPLM 

Raffaello 

STS-108 

8A 

April 8, 2002 

SO Truss, Mobile Transporter 


STS-110 

UF-2 

June 5, 2002 

MPLM 

Mobile remote servicer Base System (MBS) 

Leonardo 

STS-111 

9A 

October 7, 2002 

SI Truss 


STS-112 

11A 

November 23, 2002 

PI Truss 


STS-113 

LF-1 

July 26, 2005 

MPLM 

MPLM ESP-2 

Raffaello 

STS-114 

ULF-1.1 

July 4, 2006 

MPLM 

Leonardo 

STS-121 

12A 

September 9, 2006 

P3/P4 Truss 


STS-115 

12A.1 

December 9, 2006 

P5 Truss 


STS-116 

13A 

June 8, 2007 

S3/S4 Truss 


STS-117 

13A.1 

August 8, 2007 

S5 Truss and MPLM ESP -3 


STS-118 

10A 

October 23, 2007 

Node 2 

Harmony 

STS-120 

IE 

February 7, 2008 

European Laboratory 

Columbus 

STS-122 

1J/A 

March 11, 2008 

Special Purpose Dextrous Manipulator 
(or Dextre) 

Japanese Experiment Logistics Module 
Pressurized Section (also known as the 
Japanese Experiment Logistics Module - 
Pressurized Section) 


STS-123 

1J 

May 31, 2008 

Japanese Pressurized Module 
(Japanese Experiment Module [JEM]-PM) 

JEM Robotic Arm (JEM-RMS) 

Kibo (“Hope”) 

STS-124 


(continued next page) 
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Table 2. (continued) 


ISS 

Assembly 

ID 

Launch Date 

Element 

Public Name, 
if applicable (English 
Translation) 

Launch 

Vehicle ID 

ULF-2 

November 14, 2008 

MPLM 

Leonardo 

STS-126 

15A 

March 15, 2009 

S6 Truss 


STS-119 

2J/A 

July 15, 2009 

Japanese Exposed Facility (JEM-EF) 


STS-127 

17A 

August 28, 2009 

MPLM 

Leonardo 

STS-128 

5R 

November 10, 2009 

Mini Research Module-2 (MRM-2) 

Poisk (“Explore”) 

Soyuz-U/Progress 

ULF-3 

November 16, 2009 

Expedite the Processing of Experiments 
to the Space Station (EXPRESS) 

External Logistics Carriers (ELC 1 & 2) 


STS-129 

20A 

February 8, 2010 

Node-3 and Cupola 

Tranquility (Node-3) 

STS-130 

19A 

April 5, 2010 

MPLM 

Leonardo 

STS-131 

ULF-4 

May 14, 2010 

MRM-1 

Rassvet (“Dawn” as in 
daybreak) 

STS-132 

ULF-5 

February 24, 2011 

PMM (was Leonardo) ELC-4 


STS-133 

ULF-6 

May 16, 2011 

Alpha Magnetic Spectrometer and 

EXPRESS Logistics Carrier 3 


STS-134 

ULF-7 

July 8, 2011 

MPLM 

Raffaello 

STS-135 

Commercial 

Resupply 

Services-8 

April 8, 2016 

Bigelow Expandable Activity Module 


SpaceX 

Falcon 9 

3R 

August 2018 
(scheduled) 

Multipurpose Laboratory Module with 
European Robotic Arm 

Nauka (“Science”) 

Proton 

6R 

2018 (scheduled) 

Node Module 

TBD 

Soyuz 

TBD 

TBD 

Science-Power Module 

TBD 

TBD 


arrays launched in 2000 (Chapter 9). 
These arrays provided power for 
the core systems in the early phase 
of the ISS. Since the truss was not 
yet completed, and to ensure that 
dynamic forces such as atmospheric 
drag worked uniformly on the ISS, 
the P6 was attached to the Z1 segment 
at the center of the structure. Later, 
when the truss had been extended, the 
arrays were retracted, P6 relocated 
to the end of the main truss, and the 
solar arrays were redeployed (see also 
Chapters 9 and 18). The Pressurized 


Mating Adapters (PMAs) numbers 2 
and 3 that serve as docking ports 
have been moved multiple times. 

The Node 2 module was delivered to 
the space station on a shuttle flight 
and was initially installed on the port 
side of Node 1 because the orbiter 
was docked at the final installation 
location of Node 2 (PMA-2). After 
the orbiter undocked, PMA-2 was 
moved to the end of Node 2. The 
Node 2 plus PMA-2 combination 
was then moved from its temporary 
position on Node 1 to its final location 


at the front of the Laboratory module 
via the robotic arm (Chapter 15) 
before the next shuttle mission. 
Subsequent shuttle missions docked 
to the PMA that attached to Node 2 
on the “front” of the space station. 
PMA-3 was moved to the Zenith port 
on Node-2 in March 2017 to support 
a second commercial crew docking 
port. An excellent video that shows 
the full assembly sequence, including 
this complicated dance, can be 
found at: https://archive.org/details/ 
ISSAss emblyAnimation-2011 . 
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Figure 6. An example of a standard rack being installed in the Japanese Experiment Module. The rack is partially rotated into place on its pivot points 
(Chapter 3) while an astronaut works on connections behind it. To the right of the image is a fully installed rack. 


Standardized racks are fundamental 
components of the ISS (Figure 6). 
These racks are carried up in US 
and Japanese cargo vehicles and 
transferred to the ISS where they fit 
into contoured rack bays. Some bays 
are outfitted with power, computer, 
cooling, vacuum, or ventilation 
systems. In this fashion, equipment 
can be taken to or returned from the 
ISS. Many of the core racks contain 
vital hardware such as computers 
and pumps, but research payloads 
are also supported in this fashion. 
Thus, for example, a rack to study 
combustion in space is installed into 


a bay. With a few quick connections 
for power, computer interface, 
cooling, and vacuum ducts, it is 
ready to conduct ground-breaking 
research either with the astronauts’ 
support or remotely from the ground. 
When its research is complete, the 
rack can be returned to Earth to be 
fitted with a new experiment. With 
the retirement of the Space Shuttle, 
several vehicles can transport racks 
to the ISS, but only one can return 
them to the Earth (Chapter 14). 

Another level of modularity on the 
ISS is that almost all hardware can be 
replaced. Wherever possible, systems 


consist of Orbital Replacement Units 
(ORUs). The ORU is designed so that 
if it fails—or, as happens in some 
cases, is upgraded—the astronauts 
can take out the old one and put in 
the new unit. This may sound obvious 
when designing anything, let alone 
a multibillion-dollar space vehicle; 
however, it adds complexity and is 
a trade against cost and engineering 
challenges. For example, take a pump 
that moves cooling fluid around. The 
pump contains many elements such 
as electronics, motors, and valves, so 
there is always a chance that some 
component may fail. However, the 
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pump cannot simply be pulled out 
because the cooling fluid will go 
everywhere. Therefore, valves that 
can be closed off to isolate the pump 
from the fluid must be installed. 

These extra valves add cost and 
weight, and require software to 
control them. Since valves can fail, 
they too must be replaceable. ORUs 
exist on the inside or outside of the 
ISS. External ORUs are usually 
stored on External Stowage Platforms 
(ESPs) or Expedite the Processing 
of Experiments to the Space Station 
(EXPRESS) Logistical Carriers that 
are mounted on the truss of the ISS. 

The Team Behind The Curtain 

Flight control has been a key part 
of spaceflight since the first rockets 
left the Earth’s gravity. In fact, the 
roots of flight control go back to 
aircraft tests that were conducted 
before the space age, such as the 
breaking of the sound barrier by 
Chuck Yeager in 1948, or the ultra- 
high altitude balloon flights of the 
1950s (Ryan, 2003). Christopher 
Columbus Kraft Jr. adapted existing 
flight control processes for operating 
NASA’s crewed spacecraft in the 
beginning days of Project Mercury 
in the early 1960s (Kraft 2001). 
Additional historical details may 
be found in Herd, Dempsey, and 
van Leeuwen (2013). 

The FCT is a rather large group of 
console operators, support personnel, 
and systems engineers. A clear 
hierarchy starts at the flight director’s 
console. While on console, “Flight” 
leads all the real-time operations. 

In reality, there are layers above 
Flight including the ISS Mission 


FLIGHT DIRECTOR AUTHORITY 

A. THE MISSION CONTROL CENTER HOUSTON (MCC-H) FLIGHT 
DIRECTOR OR THE MISSION CONTROL CENTER MOSCOW (MCC-M) 
FLIGHT DIRECTOR WILL BE IN CHARGE OF EXECUTION OF 
REAL-TIME STATION OPERATIONS AT ALL TIMES AS THE LEAD 
FLIGHT DIRECTOR. REFERENCE FLIGHT RULE {B1-10}, 

LEAD ROLE HANDOVER. 

The ISS crew and flight control teams must have a clear understanding 
at all times of who is directing the real-time station operations. 

B. THE MISSION CONTROL CENTER-HOUSTON (MCC-H) FLIGHT 
DIRECTOR HAS INTEGRATION RESPONSIBILITY OF THE ON- 
ORBIT OPS SUMMARY (OOS), THE OOS UPDATES, SHORT TERM 
PLANS (STP’S), ONBOARD STP’S (OSTP’S) (IF DIFFERENT FROM 
THE STP’S), AND THE EXECUTE PACKAGES, SUMMARY PLANS, 
WEEKLY PLANS, AND DAILY PLANS (IF DIFFERENT FROM THE 
WEEKLY PLANS), AND OVERSIGHT OF REAL TIME OPERATIONS 
CONSISTENT WITH RULE {B1-9}, MCC RESPONSIBILITY 

MCC-H and MCC-M will be involved at all stages of ISS assembly and 
operation. The lead MCC Flight Director will always work to forge a 
consensus among all partner control teams both when working real time 
and in planning issues. 


Figure 7. A sample of a flight rule, in this case showing the authority of the flight director between 
the Mission Control Centers in Houston and Moscow. 


Management Team (IMMT), which 
is controlled by the Program Office. 
Technically, the ISS Program Office 
owns the space station and its 
operation is delegated to the FCT in 
the Flight Operations Division. The 
head of the ISS Program manages the 
mission requirements and objectives 
as well as the vehicle constraints. The 
head of the ISS Program Office, or 
his or her delegate, chairs the IMMT. 

Before a mission or activity, the FCT 
will write flight rules and a mission 
plan based on these objectives and 
constraints. Flight rules are pre¬ 
planned decisions and agreements 


that have been approved by the 
program. They are used to guide the 
FCT when time is of the essence. 

An example is shown in Figure 7. 

The mission plan is not only a 
timeline, it is a schedule of constraints 
(e.g., activity B is dependent upon the 
successful completion of activity A). 
When things go well, the team follows 
the rules, procedures, and timeline. 
Where possible, likely failures are 
anticipated and some level of products 
dealing with those cases are also 
created. If something goes wrong, or 
off-nominal, the flight director will 
determine whether the preapproved 
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Figure 8. The main control room, FCR-1, in NASA’s Mission Control Center in Houston, Texas. Flight Director Robert Dempsey (standing) leads the team as 
the Space Shuttle Endeavour approaches the ISS (two far-left video screens). The center screen projects a map of the Earth and the trajectory of the ISS as it 
orbits (top portion of screen), as well its orientation (bottom two panels of the screen). The right screen displays a history of all ground commands to the ISS 
as well as the status of any alarms on the ISS. Clocks for various activities are in amber along the top of the screens. 


rules cover the situation and, if not, 
consult the IMMT, time permitting. 
Otherwise, he or she will act to ensure 
the safety of the crew and the vehicle. 

The structure of the flight control 
room around the world, whether 
for probes, satellites, or missions 
with astronauts, is pretty much the 
same and has changed little over the 
decades. The flight director directly 
interfaces with, and oversees, the team 
in the Flight Control Room (FCR), 
pronounced “Acker” (Figure 8). This is 
the room normally seen on television 
during missions. The ISS flight 
controllers sit in FCR-1, whereas the 
Space Shuttle operators sat in the 
White FCR. Simulation training is 


conducted in different control rooms. 
The front of the FCR usually contains 
large screen displays—video, Earth 
map, clocks—that the entire team uses 
to maintain “situational awareness” 
during the mission. An important 
situational awareness display showing 
malfunctions on the spacecraft is often 
displayed in the front of the room, as 
well. For the ISS, this is called the 
Caution and Warning Summary (see 
also Chapter 5). Various consoles 
that are specialized on a subset of 
spacecraft systems dot the room. Six 
systems—power, computer control, 
communication, attitude control, 
thermal control, and life support- 
make up the core systems, which 


are required to keep the vehicle 
and crew alive. Additional consoles 
support specific tasks such as robotics, 
spacewalks, and timeline planning. 

The FCR operators may be supported 
by one or more additional operators 
in other areas of Mission Control, 
commonly called backrooms or 
formally referred to as a Multipurpose 
Support Room, pronounced “mipser.” 
Unlike other industries such as nuclear 
power plants, an operator is not 
assigned to monitor safety in real time, 
as the flight rules and training builds 
that function into the operations. Each 
system has its own call sign and logo, 
developed and displayed with a great 
deal of pride (see Table 3). Not listed 
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Table 3. ISS Flight Control Positions during the Evolution of the ISS. The first column lists the system, whereas the second indicates the call sign of the 
person who operated the listed system during the assembly phase. Backroom support is listed in column three along with the call signs. During the assembly 
sequence, several positions were merged into two Gemini positions during some shifts; these positions and their call signs are listed in the 4th column. 

The name Gemini was chosen since the core systems were merged into two positions. After the assembly of the ISS was complete, several positions were 
permanently combined as shown in the last column. Generally, these positions do not use backroom support, or do so only during special mission activities. 


Position 

Name 
(call sign) 

Backroom Support (or 
Multipurpose Support Room) 

Gemini Phase Name 
(call sign) 

Current Name 
(call sign) 

Motion Control 

Attitude 

Determination and 
Control Officer 
(ADCO) 

HAWKIff 

Telemetry Information Transfer 
and Attitude Navigation (TITAN) 

Attitude 

Determination and 
Control Officer (ADCO) 

Command & Data 
Handling 

Onboard Data 
Interfaces and 
Network (ODIN) 

Resource Avionics Engineer 
(RAVEN) 

Communications Rf 
Onboard Network 
Utilization Specialist 
(CRONUS) 

Communications 
and Tracking 

Communications 
and Tracking 

Officer (CATO) 

STAtion Radio frequency (Rf) 
Communications (STARCOM) 
Assembly Video Engineer 
(AVENGER) 

Electrical Power 
Systems 

Power, Heating, 
Articulation, 

Lighting Control 
(PHALCON) 

PHALCON: Power Resource 

Officer (PRO) 

SPARTAN: Station Power 
Operations Controller (SPOC) 

Atmosphere Lighting Articulation 
Specialist (ATLAS) 

Station Power, 
ARticulation, 

Thermal ANalysisf 
(SPARTAN) 

Environmental 
and Life Support 
Systems 

Environmental 
Control and Life 
Support Systems 
(ECLSS) 

Atmosphere/Consumables 

Engineer (ACE) 

Environmental and 
Thermal Operating 
Systemst (ETHOS) 

Thermal Control 
Systems 

Thermal Operations 
and Resources 
(THOR) 

Thermal Control (TCON) 

Structures and 
Mechanisms 

Operations Support 
Officer (OSO) 

OSO Support 


Operations Support 
Officer (OSO) 

Planning 

Operations Planner 
(Ops Planner) 

Long Range Planner (LRP) 

Resource Planning Engineer (RPE) 
Orbital Communications Adapter 
(OCA) 

Operations Planner (Ops Planner) 

Operations Planner 
(Ops Planner) 

Flight Director 

Flight Director 
(FLIGHT) 


Flight Director (FLIGHT) 

Flight Director 
(FLIGHT) 

Spacecraft 

Communicator 

Capsule 

Communicator 

(CAPCOM) 


Capsule Communicator 
(CAPCOM) 

Capsule 

Communicator 

(CAPCOM) 

International 
Partners Liaison 

Remote* Interface 
Officer (RIO) 

Houston Support Group (HSG) 
Columbus Support Group (CSG) 
SSIPC Support Group (SSG) 

Houston Support Group (HSG) 
Columbus Support Group (CSG) 
SSIPC Support Group (SSG) 

Remote* Interface 
Officer (RIO) 

On-board 

computer 

networks 

PLug-in-plan and 
UTilization Officer 
(PLUTO) 

PLUTO Support (PLUTO Support) 

PLUTO Support (PLUTO Support) 

Plug-in-Plan and 
Utilization Officer 
(PLUTO) 

Medical support 

BioMedical 

Engineer (BME) 

Crew Health Care System 

Hardware (CHeCS) 

Crew Health Care System 

Hardware (CHeCS) 

BioMedical Engineer 
(BME) 

Surgeon 

Surgeon 

(SURGEON) 


Surgeon (SURGEON) 

Surgeon (SURGEON) 

Ground Systems 
and Networks 

Ground Controller 
(GC) 

Numerous support positions 
such voice, command and 
communications systems 

Ground Controller (GC) 

Ground Controller 
(GC) 

Trajectory and 
Tracking 

Trajectory 

Operations Officer 
(TOPO) 


Trajectory Operations Officer 
(TOPO) 

Trajector Operations 
Officer (TOPO) 

Pointing position 
of the ISS 

Pointing Officer 
(Pointing) 


Pointing Officer (Pointing) 

Pointing Officer 
(Pointing) 

Stowage tracking 

Cargo Integration 
Officer (CIO) 


Integrated Stowage Officer (ISO) 

Integrated Stowage 
Officer (ISO) 


(continued next page) 
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Table 3. (continued) 


Task-Specific Positions 

Robotics 

Robotics Officer (ROBO) 

Mobile Servicing System - 
Systems (Systems) 

Mobile Servicing System - 
Task (Task) 


Robotics Officer (ROBO) 

Spacewalks 

Extravehicular Activity (EVA) 

Systems (EVA Systems) 

Tasks (EVA Tasks) 

Extravehicular Mobility Unit (EMU) 


EVA 

Visiting Vehicles 

Visiting Vehicles Officer (WO) 

Automated Rendezvous Officer 
(ARO) 

Visiting Vehicle Dynamics 
(VV DYN) 


Visiting Vehicles Officer (WO) 

Integration for 
Visiting Vehicles 

Integration and Systems 
Engineer (ISE) 



Integration and Systems 
Engineer (ISE) 


* Initially Russian Interface Officer until additional partners added when it was changed to Remote Interface Officer 
f SPARTAN operates the external thermal systems and ETHOS controls the internal. 

ft The origin of this name is less straightforward than the other positions. The letters do not spell out words; they are actually 
standard mathematical symbols: Momentum (H), Attitude (A), Angular Rate (w), Kinetic Energy (K), Moment of Inertia (I) 


in Table 3, but still an important part 
of the team, is the payload operations 
director who is the flight director 
equivalent for the science operations 
that are run out of the Payload 
Operations Integration Control Center 
in Huntsville, Alabama. 

The FCT has evolved over the 
life of the ISS. Between the first 
element launch (1998) and the first 
crew (Expedition 1) taking up a 
permanent residence in 2000, the 
FCT only worked one 9-hour shift 
a day, Monday-Friday, to check 
on the systems, as limited as they 
were. Outside of this window, the 
station duty officer and flight director 
monitored the systems, calling in the 
full team when needed to support 
a major dynamic activity or to deal 
with an anomaly. With astronauts 
and cosmonauts on board beginning 
in 2000, the core team supported 
24/7, 365 days a year. Two Gemini 
officers monitored the six core 


systems to relieve burnout of the team 
during quiet times, typically during 
crew sleep or off-duty weekends. 

All consoles and the Multipurpose 
Support Room were staffed during 
major events such as shuttle missions 
or spacewalks. After assembly was 
completed, it was possible to reduce 
the number of flight controllers 
since systems were now fully mature 
and configurations changed less 
frequently. Several disciplines were 
merged in 2010, and most positions 


do not have backroom support, except 
for major activities. On the weekends 
or when the crew is asleep, non-core 
systems personnel can go home, 
albeit staying on-call for problems. 
Flight and ground control are always 
on console. 

Flight controllers communicate 
with each other via voice loops. 
Although the control room always 
appears serene and peaceful, chaos 
is generally reigning in the ear of 
an operator. Each operator wears 


As with the Space Station, 

Mission Control Also Evolves 

The Blue FCR was the original control room for the ISS. Before the ISS, this 
control room was the Special Vehicle Operations room from which single 
mission projects, such as the Hubble Space Telescope servicing flights or 
specific payload launches, would be operated. Later, the ISS team moved 
into the FCR-1, which was the original FCR built at Houston’s Mission 
Control Center in 1965. Apollo 7, Apollo-Soyuz Test Project, Skylab, some 
Space Shuttle missions, and the ISS have all been operated from FCR-1. 
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a headset that is plugged into an 
audio display panel. There are 
approximately 20 audio conference 
channels or “loops” on a given 
display, and 10 displays to choose 
from. Using the display, the controller 
can select which loops to listen to 
and which one loop on which to 
talk. Four loops are reserved as the 
primary channels for the astronauts 
and ground to communicate. These 
are designated as Space-to-Ground 
1, 2, 3, and 4. Additional channels are 
described in Chapter 13. One of the 
first skills a controller needs to master 
is the ability to listen to multiple 
conversations simultaneously, picking 
out the things that affect him or her 
directly, hold conversations above 
the cacophony, and stop everything 
instantly when there is a call on the 
space-to-ground loops from the crew. 
To facilitate this process, the FCT 
uses codes and special phrases to 
keep discussions concise and crisp, 
as described in Chapter 10. 

Staffed by NASA and contractor 
engineers (primarily from the Boeing 
Company), the Mission Evaluation 
Room (MER) also supports 
operations. As the primary contractor 
of the ISS since the early days of the 
program, the Boeing Company and 
its subcontractors designed and built 
the majority of the US ISS hardware. 
These MER personnel retain and 
manage valuable design specifications, 
manufacturing documentation, and 
general system knowledge that is 
highly beneficial for the operation 
of the space station. The MER 
supports the operations team with a 
structure similar to that of the FCT 
(i.e., a Command and Data Handling 


subject matter expert that supports 
the Communications Rf Onboard 
Network Utilization Specialist flight 
controller). Each MER discipline 
has its own call sign and set of loops 
to communicate among themselves 
or the FCT. As with the controllers, 
the MER team has a leader called 
the MER manager, which is similar 
to the flight director. The MER 
manager is consulted if a question 
comes up during operations, such as 
how something worked in testing or 
how the software might respond in a 
particular configuration. If the MER 
does not have the information on 
hand, he or she will consult with the 
vast Boeing organization to collect 
and provide the data. Generally, the 
MER is staffed only between the hours 
of 9:00 a.m. - 5:00 p.m., Monday- 
Friday, but is supported around the 
clock during major activities or if an 
anomaly occurs. In the event of an 
anomaly, it is the MER’s function to 
gather data, ascertain the problem, 
and devise a fix. These activities are 
coordinated with the FCT throughout 
such investigations. 

As owners of the ISS, the Program 
Office also has a team that supports 
operations on a regular basis. This 
team, the ISS Management Console, 
provides coordination with the 
program management, including 
keeping them apprised of all 
activities, successful or not, as well 
as coordinating with the management 
teams of the other partners. 

Finally, representatives from the 
international partners maintain some 
presence in the Mission Control 
Center-Houston, mainly to help with 


the integration of the operations from 
day to day. Most notable among 
the partners presence is that of the 
Russians, who maintain a small team 
of flight controllers, trainers, and a 
flight director as part of what is called 
the Moscow Support Group. Besides 
performing coordination tasks, 
the group can operate the Russian 
Segment in the event of a significant 
problem with the control center near 
Moscow. Likewise, NASA maintains 
a small team in Russia known as 
the Houston Support Group. NASA 
and the international partners also 
exchange support group personnel, 
though sometimes only during critical 
mission phases. 

Flight control is different for the 
ISS than it was for the shuttle and 
earlier spacecraft. In the case of the 
Space Shuttle, the astronauts were 
responsible for most operations, 
and the ground followed along. 
Almost all commands to the vehicle 
were “switch throws” or other 
similar operations by the crew. In 
contrast, the vast majority of the ISS 
commands are sent from the ground. 
This allows the crew to focus more 
on the science payloads and less on 
vehicle operations. A typical day 
during a shuttle mission saw the FCT 
uplink less than 500 commands. The 
collective station FCTs, located all 
around the world, routinely send 
50,000 commands per day to the ISS. 

It takes several years to become a 
certified flight controller (see also 
Chapter 10). Although, generally, the 
team is made up of engineers—and 
positions and degrees are highly 
correlated (e.g., an electrical engineer 
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Figure 9. Control centers that affect the ISS around the world. 


supports the power systems https:// 
www.nasa.gov/sites/default/files/ 
atoms/files/np-2015-05-022-jsc-iss- 
guide-2015-update-111015-508c.pdf 
a computer scientist might support the 
computer systems)—it is not strictly 
required. Math and English majors 
and even astronomers have been, 
and still are, flight controllers. Initial 
training provides every new person 
with general knowledge of spaceflight 
operations, the vehicle, visiting 
spacecraft, the NASA organization, 
how to work with international 
partners, and even how to conduct 
meetings. Training involves 
completing computer-based training, 
reading manuals and instruction 
books, and attending classroom 
lessons. Eventually, the student 


supports simulations where the 
operations of the ISS are reproduced 
by computers and significant failures 
can be experienced by the team. 
Training in general and simulations 
specifically are described in more 
detail in Chapter 10. Once certified, 
flight controllers, instructors, and 
flight directors all must continue to 
perform proficiency training and 
evaluation to ensure they remain 
at peak performance levels. Flight 
directors are generally selected from 
seasoned flight controllers. As of 
2017, 91 individuals have become 
certified NASA flight directors. 

Similar structures, room layouts, 
training, and operations occur in 
the various control centers around 


the world that manage the ISS 
(Figure 9). See also Herd, Dempsey, 
& Leeuwen. (2013). Joint training 
between the various control centers 
is performed for specific mission 
activities (e.g., activating the 
Columbus module, docking the 
European cargo vehicle). Pictures of 
the different control centers can be 
found in https://www.nasa.gov/sites/ 
default/files/atoms/files/np-2015- 
05-022-jsc-iss-guide-2015-update- 
111015-508c.pdf. The control rooms 
of the CSA Space Operations Support 
Center (see also Chapter 15) and 
the Payload Operations Integration 
Center are shown in Figure 10. The 
American visiting vehicle control 
centers are displayed in Chapter 14. 
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Figure 10. Other key USOS control centers. The top image is of the CSA Space Operations Support Center in St. Hubert, Quebec, which supports robotics 
operations. The bottom image is of the Payload Operations Integration Center in Huntsville, Alabama. 
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Naming Conventions 

Flight controllers and their flight 
director can hold whole conversations 
awash in acronyms or “NASA speak.” 
Throughout the book, we have tried 
to use as few acronyms as possible. 
Unfortunately, it is not possible 
to tell the story of the ISS without 
referencing many of the common 
terms. This will be explained, when 
used. A complete list can be found in 
the Appendix. 

Another challenge with this topic is 
that it is international. Under NASA 
integration, all operations on the 
USOS are conducted in English. 

All procedures, labels, and even 
discussions with the astronauts 
use English. An exception to this 
rule are the Russians. All of their 
systems, flight control operations, 
and cosmonauts use Russian and, of 
course, the Cyrillic alphabet. Critical 
systems or emergency procedures are 
marked in both. The US FCT needs to 
be versed to some extent in Russian, 
since it is used when communicating 
with their counterparts. Thus, 
everything on the Russian Segment 
may have a Russian name, a Cyrillic 
acronym, an English transliteration, 
and an English acronym. Brackets 
are placed around the letters to 
indicate a transliteration from regular 
English acronym. For example, the 
central computer on the Russian 


Segment (Table 4), which is shown 
in Chapter 3, interfaces with the main 
computer on the USOS. This book 
will use the English acronym. 

Book Layout 

This book is comprised of two types 
of chapters. Ten chapters provide 
an overview of the key systems on 
the ISS. These are the computer, 
communications, thermal control, 
life support, power, structures, and 
motion control systems. Each one 
of these is critical to supporting 
the crew and the other systems 
so that the ISS can continue to 
operate. Additional technical detail 
can be found in Chamitoff and 
Vadali (2018). Although one would 
not consider them core systems, 
the planning, robotics, and EVA 
(i.e., spacewalking) functions are 
extremely critical to the construction 
and operation of the space station. 
These systems are therefore included 
in the technical chapters. These 
chapters provide the foundations 
for the remaining “Day in the Life” 
chapters, which detail the operations 
of the ISS by the FCT. 

Each Day in the Life chapter 
focuses on a theme in the area of 
operations. The themes will cover 
the routine operations of the space 
station—though it might be argued 
that nothing is routine in space— 


and the unusual or contingency 
operations. Change supported by 
flexibility and adaptability make up 
the reality of operating a complex 
vehicle in space. Chapter 2 describes 
the day-to-day life during the time 
an increment crew is on the ISS, 
whereas Chapter 4, The Making of 
a Mission, describes the process of 
putting together and executing major 
missions using a shuttle assembly 
flight for illustration. A specific 
example of change is discussed 
in “Brain Transplants” of the ISS 
(Chapter 6) where, as with terrestrial 
desktops, laptops, and smartphones, 
the software that is operating the 
vehicle is completely updated. 
Low-Earth orbit is a dangerous 
place for many reasons, but most 
notably due to a large amount of 
debris that, if it struck the ISS, could 
kill the crew. Therefore, the FCT 
continuously monitors this debris and 
occasionally maneuvers the space 
station out of the way, as described 
in Chapter 8. Training is critical, and 
Chapter 10 provides a small flavor 
of that world from the viewpoint of 
the team members as they simulate 
life and death on the station. Flight 
controllers have to spend a great deal 
of time planning for the unexpected 
and preparing for contingencies 
that, if things go well, may never be 
needed. Having the crew members 
abandon the station and come home 
in order to save their lives is one of 


Table 4. Example of Russian-English Acronym Reference 


Russian Name 

Russian Cyrillic 
Acronym 

Translation 

English 

Transliteration 

English 

Acronym 

Cjiy5Ke6m>m MO^ynt 
iieHTpajitHoro KOMiiBioTepa 

(Sluzhebnyy moduli’ 
tsentral’nogo komp’yutera) 

EBM 

Service Module 
Central Computer 

[TsVM] 

SMCC 


XXX 









the things the ground team has to 
think about. If the unfortunate day 
ever comes, NASA will be prepared 
(Chapter 12). As with any remote 
outpost, supplies and fresh personnel 
have to be brought to the station and 
ferried home. This process, which 
has also evolved significantly over 
the lifetime of the space station, is 
discussed in Chapter 14, along with 
the continuous coming and going of 
these visiting vehicles. As can happen 
in any home or research facility 
on Earth, things sometimes break 
or need to be modified. In-Flight 
Maintenance (Chapter 16) discusses 
making these repairs—whether it 
be finding a leak, or fixing a stuck 
hatch or a broken computer. Some 
installations or repairs require 
a spacewalk, as described in 
Chapter 18. More serious failures 
also occur in space, such as when the 
pump that controls half of the critical 
cooling system on the ISS fails. In 
this case, all systems are affected and 
every team, including robotics and 
EVA, are involved in the recovery 
in what is known as an “all hands 
on deck” scenario. These cases are 
discussed in Chapter 20, “When a 
Major Anomalies Occur.” 

Acronyms, references, and 
information on the authors of this 
book can be found in the Appendix. 




Chapter 1 Systems: 

International Space 
Station Planning— 
A Roadmap to 
Getting It All Done 






Building both the pyramids and the International Space Station presented significant logistical challenges that required careful planning. 

Clockwise from upper left: the pyramids of Giza, the completed space station, Mission Control, a graphic showing the construction of the pyramids. 


More than 4,500 years ago, Egyptian 
pharaoh Khufu and his architects 
stood upon the Giza plateau near 
modern-day Cairo and contemplated 
the building of what was at the time, 
and is still considered to be, one of 
the most immense undertakings of 
humankind: the building of the great 
pyramids of Giza. Foremost in their 
minds was the scale and complexity 
of the task, and the organization, 
choreography, and supply of the vast 
number of architects and laborers 
needed to complete the job. Thus, 
one of the seven wonders of the 
ancient world was completed over 
a period of 20 years through careful 
planning and execution, as well as by 
establishing a reliable supply chain 
of food and materials. 


It has been argued that the scale, size, 
and complexity of the International 
Space Station (ISS) along with the 
distributed international workforce 
of engineers, managers, technicians, 
and scientists is this era’s equivalent 
to the pyramids. As a result of careful 
long- and short-range planning and 
a well-developed logistics plan, the 
ISS has served as a continuously 
occupied human outpost and 
research laboratory in low-Earth 
orbit since November 2000. Unlike 
the pyramids, however, the ISS 
has evolved significantly during 
and subsequent to its construction, 
adapting to catastrophe (e.g., Space 
Shuttle Columbia) or political goals. 

This chapter focuses on both 
long- and short-range planning. 

Any activity that occurs on the 


ISS—whether it be running a 
science experiment or performing a 
spacewalk—takes years of planning 
and preparation. The ISS Program 
office first lays out high-level 
priorities and plans years in advance. 
When will a supply mission launch? 
Who will the crew members be? 

Will the astronauts stay on orbit 
for 6 months or a year? When will 
spacewalks be needed? More and 
more details are worked out as the 
time for a mission approaches. A 
robust planning process also allows 
for change, whether it is due to 
a failure or problem, or simply a 
change in priorities. During any 
given week, hundreds of activities are 
performed, each with its own resource 
needs (e.g., power, sample bags), 
constraints (e.g., needing the same 
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physical space), or crew availability 
(e.g., a given crew member trained 
for a particular task). The focus of 
this chapter is on the increment, 
typically a 6-month stay for a crew, 
where multiple events—spacewalks, 
supply missions, scientific research— 
take place, whereas Chapter 4 details 
the planning process for a specific 
mission. The long- and short-range 
planning process will be discussed 
along with the specific products and 
groups involved. With assembly of 
the ISS complete, the ultimate goal in 
planning is to maximize the amount 
of research that will be performed by 
a well-resourced crew. 

Long-Range Planning— 
Building Up to the Increment 

Years in advance, ISS Program 
personnel lay out a high-level 
manifest. The focus of this manifest 
is primarily supply—i.e., when 
will cargo vehicles be available 
to transport critical food, water, 
oxygen, fuel, spare parts, clothing, 
and scientific payloads. Since supply 
vehicles can, and have, failed to reach 
the station (e.g., the Russian Progress 
and the American Orbital and SpaceX 
launch failures in 2014 and 2015), 
the program tries to allocate extras 
wherever possible. Another factor in 
this planning may be the availability 
of hardware. For example, an 
experiment might be planned for a 
particular increment; however, if the 
hardware runs into unexpected issues 
during development, the schedule 
will slip, perhaps to an increment 
that does not have the necessary 
upmass capability or enough 
crew time available due to higher 
priorities. Approximately 2 years 
prior to a given increment, ISS 
Program personnel, with input from 
the operations team, begin detailed 
planning by establishing priorities for 
a given increment. These priorities 


are documented in an increment- 
unique requirements document 
called the Increment Definition 
and Requirements Document 
(IDRD). The IDRD contains 
specific categorical requirements for 
areas such as medical operations, 
science operations, photography, 

ISS maintenance, and equipment 
manifests. Unique to each increment, 
the IDRD is used in conjunction 
with a more-generic requirements 
document called the Generic 
Groundrules, Requirements, and 
Constraints (GGR&C), which applies 
to all increments. The GGR&C 
provides general requirements for 
all activities. For example, it dictates 
that the astronauts should normally 
plan for at least 8.5 hours of sleep per 
day, 2 hours of pre-sleep to unwind 
and prepare for bed, and 1.5 hours 
of post-sleep to wake up, perform 
hygiene duties, and prepare for the 
day. The execution planning teams 
use this document as the primary 
guidance for developing the plans that 
will be described in this chapter. 

The primary focus of the IDRD 
development phase is to define 
requirements for the increment (e.g., 
number of spacewalks or reboosts 
needed to maintain vehicle altitude). 
Since there is always more to do than 
available time or resources allow, the 
IDRD provides priorities to aid in 
decision making during execution, 
should trades need to be made. The 
IDRD also details the availability and 
expected use of key consumables that 
the ISS uses over the course of the 
increment. Managing consumables is 
also a complex process. Consumables 
include those needed for life support 
as well as for the spacecraft or 
experiments. Program personnel 
estimate how much oxygen, water, 
fuel, etc. are needed. This can be a 
tricky calculation because individual 
crew members consume oxygen and 
water at different rates. Even fuel 


can be difficult to manage because 
the altitude of the ISS is affected 
by a number of parameters, not the 
least being the irregular activity 
on the surface of the sun. Once 
the needs are identified, program 
personnel evaluate the available 
upmass—i.e., which launch vehicles 
have available space. Something 
big or heavy being launched on one 
vehicle means less available upmass 
for other items. Program personnel 
put forth considerable effort 
analyzing the stowage configuration 
throughout the increment based on 
the visiting vehicle traffic plan along 
with the expected trash generation 
and disposal plan. Development 
of the research plan—specifically, 
which experiments will fly, and when 
those experiments will fly—occurs 
in parallel with this planning. This 
intricate planning can be especially 
challenging when an experiment, 
new hardware, or even a replacement 
part is not ready as scheduled, due to 
unexpected challenges. 

Program requirements determine 
how much time is available for 
specific activities. Per the GGR&C, 
astronauts are required to have 
8.5 hours a day allocated for sleep. 
Four hours a day are set aside for 
post-sleep and pre-sleep, 3 hours for 
meals, and approximately 2.5 hours 
for exercising. Daily planning 
conferences are scheduled twice a 
day to allow the ground and crew 
time to tag up on the activities about 
to be performed or completed. Time 
for other tag-ups are also allocated 
to discuss stowage and transfer, 
especially prior to and during cargo 
resupply missions or in preparation 
for spacewalks. Since the astronauts 
are typically on the ISS for 6 months, 
unlike a short Space Shuttle mission, 
they have a half day on Saturdays to 
perform weekly housecleaning, and 
a full day on Sundays to do whatever 
they please. Several major holidays 
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per increment are also set aside for the 
crew to have time off from work. The 
remaining time is divided between 
maintenance or assembly activities 
or “utilization”—the catchphrase for 
all scientific research. Construction 
or developmental tasks dominated 
crew time during the assembly time 
frame, with little time available for 
utilization. Utilization time was so 
short in the early days of the ISS 
Program that astronauts would often 
do volunteer science on Saturdays. 
However, this practice can lead to 
overly tired crews and, possibly, 
burnout. By about 2013, 30 hours 
a week was being carved out for 
utilization, which is expected to reach 
more than 70 hours a week around 
2018 when the new US commercial 
crewed vehicles, which can carry four 
astronauts, become available. 

Crews are assigned to an increment 
at about the same time that the IDRD 
development kicks off. Early in 
the program, especially during the 
assembly phase, crew selection was 
often based on planned activities. 

For example, astronauts who were 
skilled in robotics could be assigned 
to increments where a great deal 
of robotic work might be needed. 
Similar assignments could occur for 
increments heavy in spacewalks. 

This proved challenging to the flight 
control team, astronauts, and trainers 
as schedules frequently shifted, 
often due to shuttle mission delays. 

As the ISS evolves, and as planners 
gain more experience with the ever- 
changing nature of ISS operations, 
crews are being provided with 
generic skill-based training such as 
preparation for any type of operation. 
For example, a crew might be trained 
to perform a spacewalk and change 
out a generic box instead of learning 
the specifics of a particular unit. 
Electrical connectors for all boxes are 
similar, thus specific instructions can 


Now where did I put that? 

A lot of equipment and supplies go to and return from the ISS. Experiments 
and food, for example, go up; research specimens and broken parts 
needing repair come down. Imagine keeping track of everything in your 
house over many years. Now, add in the complexity that occurs when the 
residents change every 6 months. Every bit of space on the ISS is used for 
something—e.g., if a system component or an experiment is not in a spot, 
that spot is probably being used for stowage. ISS Program personnel try 
to position as much spare parts, food, and water to keep operations going 
for as long as possible since supply rockets can, and have, failed to deliver 
precious supplies. Managing where and how to store all the supplies and 
equipment required to keep the ISS going is literally a full-time job. That job 
belongs to the Inventory Stowage Officers (ISOs) in Houston, along with 
their counterparts in Tsukuba, Munich, Huntsville, and Moscow. Most items 
have a barcode that can be read by a laser device. These barcodes are 
similar to those found on products in terrestrial stores or radio frequency 
identification chips, and are tracked in a database known as the Inventory 
Management System. The ISO works with the rest of the flight control team 
to build stowage notes for crew activities. These notes tell crew members 
where to find the tools and equipment they will need, and where everything 
goes when they are done. Gathering and stowing tools takes a significant 
amount of time and is built into the time allocation of each activity. The 
ISO works out how to unpack and put away cargo brought up to the ISS in 
arriving vehicles, how to pack whatever needs to be returned to Earth, and 
where to temporarily store items that will be thrown away. Each week, the 
ISO tags up with the crew during a short conference to make sure all the 
instructions that the crew members received for stowage management that 
week were clear, to answer any questions they may have, and to start the 
planning process for the next week. 

Even with barcodes and the ISO team on the ground, items get lost or 
misplaced. When this happens, the flight control team will actually create 
a “wanted” poster, alerting crew members to keep their eyes open for the 
missing hardware. Although most missing items are small, even large ones 
can disappear, as was the case of a pump module that measured 72.9 x 
45.0 x 45.7 cm (28.7 x 17.7 x 18.0 in.). That pump module was eventually 
found tucked behind a rack. 


be provided just prior to a specific 
extravehicular activity (EVA). 

As the increment gets closer, 
placeholder events documented in 
the IDRD (e.g., EVAs) evolve into 
specific tasks such as repairs or 
experiment payload deploy. The final 
IDRD is published 1 month before 


the start of the increment. At this 
point, planning enters the execution 
phase with the Operations Planner 
(OPS PLAN) leading the detailed 
schedule development. 

Planning by the flight control team 
begins in parallel with the final phases 
of IDRD development. This allows 
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planners to evaluate the set of 
proposed increment requirements 
for feasibility before the final 
requirements are approved while 
allowing planners to begin developing 
their databases of activities. Increment 
planning, performed by the flight 
control planning team, is broken into 
pre-increment planning and execute 
planning. The pre-increment planning 
phase begins 1 year prior to the 
increment start and ends at increment 
start—3 weeks (1-3 weeks). As 
described in detail below, the primary 
products generated during this phase 
are the Increment Overview, On-orbit 
Operations Summary (OOS), and the 
Execute Planning Groundrules and 
Constraints (Gr&C). 

Three weeks prior to start of the 
increment, the planners begin what 
is called the “execute” phase. The 
primary products of the execute phase 
are the Monthly Calendar, Weekly 
Lookahead Plan (WLP), Short Term 
Plan (STP), Onboard Short Term Plan 
(OSTP), and Daily Execute Package. 
Although this process is orderly, 
significant change is occurring 
through the entire process as ISS 
Program priorities change. Problems 
such as broken hardware or a supply 
mission delay are the main drivers for 
these changes. Thus, replanning is an 
ongoing process. 

Increment Planning 

The International Execute Planning 
Team (IEPT), led by the lead 
operations planner resident at 
NASA Johnson Space Center, 
develops the pre-increment products. 
Planning representatives from 
each international partner (see 
Introduction)—-NASA, Russia, 
Europe, and Japan—comprise the 
IEPT. The Payloads Operations 
and Integration Center organizes 
research in the United States, 


Table 1. Dates are referenced to the start of the increment (!) and the time. 1-12 indicates 12 months 
before the start of the increment. 


Increment Overview 

Increment-Specific 
Groundrules & Constraints 

On-orbit Summary 

Draft: 1-12 months 

Draft development occurs 
~l-8 through 1-4 months 

Draft development occurs 
~l-8 through 1-4 months 

Preliminary: 1-6 months 

Preliminary: 1-4 months 

Preliminary: 1-4 months 

Final: 1-1 month 

Final: 1-1 month 

Final: 1-1 month 


whereas the lead mission control 
center for each partner coordinates 
its respective research activities. 

The IEPT members conduct regular 
conferences, routinely exchange 
planning data according to a 
predefined schedule, and participate 
in two face-to-face meetings for 
pre-increment planning product 
finalization. During the execute 
planning phase, IEPT meetings 
(telecons) are conducted 3 days a 
week to facilitate WLP and STP 
development and replanning. 

A key task during pre-increment 
planning is to evaluate the feasibility 
of the program requirements. At this 
stage of the process, planners begin 
translating program requirements 
into activities and assigning these 
activities to periods of time during 
the increment to determine whether 
sufficient resources (e.g., crew time) 
are available and whether defined 
activity constraints (e.g., microgravity 
periods, sufficient day/night cycles, 
etc.) can be satisfied. Detailed 
procedures and time estimates are 
generally not available at this stage; 
however, the operations team has 
done enough analysis to have a 
reasonable estimate on how long each 
activity will take. If an activity is 
particularly complex, the operations 
team may conduct a dry run in the 
mock-up facility to improve the time 
estimate. Eventually, as the time of 
executing the activity gets closer, the 
procedure will be verified and the 
final time estimate will be available. 

If the activity has been performed 


previously or is suitably similar to 
another activity, the time can be better 
estimated. However, individual crew 
members can take a different amount 
of time to perform the same activity, 
depending on background or previous 
experience in space. The IEPT 
develops the primary products of 
this phase—the Increment Overview, 
OOS, and Gr&C—according to a 
predefined schedule (Table 1). 

The Increment Overview (Figure 1) 
is the official planning document 
until 1 month prior to beginning of 
the increment when the final OOS 
provides the information for the final 
stages of planning. The document 
contains a summary of key increment 
operations such as spacewalks and 
illustrated vehicle traffic to and from 
the ISS. Vehicle traffic includes the 
Soyuz flights that bring the new 
crew as well as the cargo resupply 
missions. Further, the Increment 
Overview provides estimates of crew 
time for research utilization. For 
example, the crew might have an 
expected amount of 30 to 40 crew 
hours available in one week for 
experiments, whereas another week 
might contain a spacewalk and may 
only have 5 to 10 hours available. 

The OOS as shown in Figure 2 is 
a high-level plan, organized by 
day, spanning the entire increment 
that addresses crew time usage and 
indicates other major operations 
(e.g., visiting vehicle arrivals/ 
departures, EVAs, significant non¬ 
crew operations, etc.). The intent 
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of the 00S is to provide an initial 
implementation of the increment 
requirements, as identified in the 
IDRD, GGR&C, and program 
directives, and establish the feasibility 
of satisfying the science commitments 
for the increment. Conversely, the 
OOS also serves to point out “hot 
spot” areas during the increment 
where crew time availability will be 
constrained or where other operations 
may not be possible to execute unless 
priorities are adjusted, often through 
detailed negotiation with the partners. 
Specifically, the OOS contains the 
following information: Greenwich 
Mean Time date, activity, activity 
location, comments, Russian ground 
site on-range times, solar beta angle 
(see Chapter 7), and increment day. 



Figure 1. Increment Overviews from the first expedition (top) and one from Expedition 41/42, 15 years later (bottom). In the top figure, the dates are placed 
across the top. Major vehicle attitude is listed, such as X-Perpendicular Out of Plane (XPOP) and local vertical/local horizontal (LVLH) as well as beta angle (see 
Chapter 7). Major activities such as a Soyuz launch are also shown below on the given date. Activities tend to be high level—Service Module (SM) outfitting, 
laboratory checkout (Lab C/0), and EVA preparation. In the bottom image, the data are essentially the same, though neither beta angle nor attitude are listed since 
the ISS now generally flies the same attitude. 
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Figure 2. Several weeks of the OOS from Increment 43, which was the first 1-year increment to the ISS beginning in March 2015. Activities and their 
durations are color coded to indicate the major category in which they belong (e.g., vehicle operations, EVA, scientific research), thus facilitating crew 
resource analysis and optimization. The operations planning team, international partners, and ISS Program office analyze the distribution and allocation 
of crew time in the OOS time frame prior to execution, primarily to assess the feasibility of IDRD requirements implementation. Task color coding persists 
through all phases of flight (pre-increment, in-flight, and post-execution reports are analyzed) so that the teams can measure progress and apply appropriate 
lessons learned to future planning cycles. 


It does not contain the specific time 
in which an activity is scheduled on 
the given day. 

The OOS is developed over 
the course of several months, 
culminating in a final version that 
the IEPT members and ISS Program 
management review and approve 
at 1-1 months. Planning takes into 
account resource availabilities 
(primarily crew time and, on 
occasion, power, etc.), trajectory 
data (i.e., solar beta angle, Russian 
ground site availability), and other 
defined constraints. Upon approval, 
the final OOS shows the plan for 
accomplishing increment objectives 
along with a detailed activity 
database. It should be noted that 
mission planners use the results from 
the development of the Increment 
Overview and the Final OOS for 


updating and developing the IDRD. 
This ensures the requirements going 
into the increment execution phase 
are aligned with the feasibility of 
implementing these requirements. 

Execute planning describes the phase 
of operations from publication of 
the Final OOS through the end of 
the increment. Execute planning 
deals with development of plans 
for execution by crew and ground 
control teams based on the OOS 
(Figure 2). The long-range planning 
(LRP) team develops these execution 
planning products. The OPS PLAN 
team is responsible for executing 
and replanning while on console in 
the Mission Control Center (MCC) 
in Houston. Both teams require 
significant interfaces with disciplines 
that are both internal and external to 


Johnson Space Center to generate 
and execute effective ISS plans. 

The LRP team generates WLPs and 
STPs using the OOS, ISS Program 
directives, current vehicle operations 
status, and unique operations 
constraints. The OPS PLAN team 
takes these timelines and generates 
executable plans, or versions of the 
STP, that the crew and ground teams 
will use to perform daily ISS tasks. 
The OSTP is the new “executable” 
version of the STP that is used by 
the crew and ground teams. At this 
point, activities are detailed enough 
that specific procedure steps, stowage 
items, and key notes directing the 
crew in how to perform the task 
have already been established. The 
OPS PLAN team further prepares 
supplementary materials (i.e., Daily 
Execute Package) to aide in daily plan 
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execution. This package includes data 
such as the current state of the ISS 
(e.g., which computers are configured 
as primary, safe angles to park the 
solar arrays in the event of a loss of 
attitude control [see Chapters 5 and 7, 
respectively]), questions for the crew 
from the previous day’s operations, 
answers to crew questions from the 
previous day, summaries of key 
operations for that day, and a list of 
the key flight control personnel from 
the various ISS control centers. Any 
changes to the plans are coordinated 
with the LRP team and are reflected 
in updates to the WLPs, STPs, and 
OSTPs. The overall WLP, STP, 
and OS TP development timeline is 
depicted in Figure 3. 


oos 




WLP 



Ground 


Onboard 


Figure 3. Plan 
Development Flow 
showing how the 
OOS feeds into 
ever-more-detailed 
products such 
as the WLP, STP, 
andOSTP 



Figure 4. WLP—list by day of crew operations and other major objectives for 1 week of ISS operations. Activity durations are listed under the crew member 
who will be performing the activity, but the specific time during the day is not yet defined. All activities are given standard reference codes that the crew and 
flight controllers understand. For example, EVA-PROC-CONF means the EVA team will have a procedure review conference with the crew on Thursday, though 
the specific time is not yet scheduled. Russian activities are shown in Cyrillic. As with the OOS, activities and their durations are color coded to indicate 
to which major category they belong (e.g., vehicle operations, EVA, scientific research). In the WLP phase, the team’s analysis of crew resource allocation 
focuses more on optimization and measuring progress, and serves as a tool for navigating planning “tradespace. ” For example, if an unplanned EVA is 
required to repair a pump module that has failed, the team must quickly understand how many hours are needed to perform a spacewalk as well as the 
hours of scientific research, periodic maintenance, or cargo transfer that must be rescheduled to make room for the contingency EVA. 
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Figure 5. The development cycle of the STP and OSTP generation cycle starting 7 days prior to the Day of Execution (Day of Exe) with each day indicated 
as Execution, or E, minus the day. All Planning Product Change Requests (PPCRs) are due 3 days prior to execution. The final plan is uplinked to the crew the 
day before execution and reviewed during the evening Daily Planning Conference (eDPC) on the planning or orbit 3 (03) shift. 


The beginning of the execution 
plan development process begins 
2 weeks prior to a week of plan 
execution with the development 
of the WLP. The LRP team begins 
WLP development by revisiting 
a particular week from the 00S 
to update the planned information 
based on recent changes encountered 
during the execution of the increment 
since the OOS was published. 

Figure 4 shows the WLP plan, which 
has a detailed list of crew activities 
assigned to each crew member for 
each day of a particular week in 
the increment, in addition to any 
significant non-crew operations on 
each day. The operations team or 
payload organization provides the 
crew time requirements for each crew 
activity planned and summarizes to 
ensure compliance with GGR&C 
crew time constraints (e.g., 6.5 hours 
of schedulable crew time each crew 
workday). The WLP plan looks 
similar to the OOS, but it contains 
the information for only a single 
week of the increment, as can be 
seen in Figure 4. Up to this point 
in the planning process, managers 
have planned and assigned all tasks 
to specific days or weeks of the 
increment, with an emphasis on crew 
time availability. Now, planners look 
at the details of the planned activities 
and begin the process of creating a 


timeline or schedule of events. Other 
constraints and resources, such as 
communications coverage, equipment 
use, day/night cycles, data bandwidth 
availability, etc., are considered at 
this phase of the planning process, 
in addition to crew time constraints. 
Details of unique activity constraints 
are contained in an activity database 
maintained by the planners as well 
as in a Gr&C document created by 
the international planning team at the 
start of the increment. For example, 
it might be the case that astronauts 
cannot eat or perform certain types 
of exercise within a certain amount 
of time prior to a medical procedure, 
such as a blood draw. Operations 
that were not completed earlier in 
the increment due to problems or 
a lack of time may, depending on 
priorities, get pushed to a later week. 
Although the program previously 
baselined the requirements for the 
increment, changes are inevitable. 
During the increment, the ISS 
Mission Management Team (see 
Introduction) approves the updates, 
which the planners also incorporate 
during this time frame. Once 
drafted and before implementation, 
the IEPT, flight controllers, and 
program managers conduct a final 
review to ensure everything fits 
within the requirements and needs 
of the program, as well as within the 


capability of the crew, ground team, 
and vehicle. This level of attention to 
detail is required since crew time is 
extremely precious and any wasted 
time can impact the success of the 
program goals. The Final WLP then 
serves as a type of contract between 
the flight team and the ISS Program 
regarding what will happen for that 
particular week. 

The STP is a timeline derived directly 
from the WLP and consists of all 
activities to be performed on the ISS 
for a particular day. Figure 5 shows 
the development timeline for an STP 
covering 1 day of ISS operations 
to take place 7 days in the future. 

As mentioned, an STP is created 
(following the template outlined in 
Figure 5) for each day represented in 
the Final WLP. The STP is presented 
as a graphical timeline of crew and 
ground activities for a particular 
day (Figure 6) to be used as an 
output from a common planning 
system shared by all ISS planning 
communities. The format includes 
horizontal bands for individual 
crew member activities, trajectory 
information (day/night, Tracking Data 
Relay Satellites for communications 
coverage, Russian Ground Sites, 

Daily Orbit Number, spacecraft 
attitude), systems and payload 
commanding, automated systems 
and payload operations, and ground 
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Figure 6. Graphic depiction of the STP timeline generated from the WLP for a particular day of the week. The top bands show when S-band or Ku 
communications coverage is available, when the day/night cycles occur, the station attitude, and even the configuration of the planned telemetry link to the 
ground. Crew member activities (e.g., CDR for Commander or FE1 for Flight Engineer 1), shown near the top, detail their specific activities. Other display 
bands indicate which activities are using the S- or Ku-band systems, and required coordination with the MCC or, in this example, what the Columbus (COL) 
flight control team members are doing. 


coordination activities. The STP is the 
baseline plan, and it takes precedence 
over the Final WLP for operations on 
that particular day. The STP is also 
loaded into a computer-based viewing 
application, the Operations Planning 
TIMeline Integration System 
(OPTIMIS), to enable easy review 
by flight controllers in all control 
centers as well as initial review by 
the ISS crew. Ultimately, on the day 
of execution (e.g., Day of Exe in 


Figure 5), the entire ISS operations 
community conducts operations 
from the OSTP—a single integrated 
timeline. Figure 7 shows an OSTP as 
depicted in the OPTIMIS application. 
During execution day, crew members 
provide an ongoing status of activity 
execution using the OSTP. Flight 
control team members provide the 
crew with an ongoing status of 
ground or on-board systems activity 
execution using the OSTP. For 


example, the crew will mark a task 
“gray,” which indicates it has been 
completed. These statuses by crew 
and ground teams are exchanged and 
synchronized to allow all plan users 
to follow the execution status on the 
ground. The Russians additionally 
communicate a subset of the official 
OSTP plan to the Russian crew 
members using a document called 
Form 24, which is essentially a text 
summary of the day’s events. 
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Figure 7. OSTP timeline of crew and ground commanding used by all control centers for daily ISS operations. This looks similar to the STP in Figure 6, 
but here it is viewed in the crew’s OPTIMIS. The dashed red line indicates the current time. A pop-up in the center provides additional detail on a specific 
activity under the cursor. 


Plan Configuration 
Management 

Early discussions with all the 
international partners during the 
formative phases of ISS operations 
development determined that the 
distributed nature of ISS operations, 
coupled with the fundamental tenant 
of a single integrated plan, required 
a rigorous configuration control 
process. Without this configuration 
control, the various control centers 
and the crew could end up working 
from old or different schedules. 
Keeping track of all the changes input 
through the WLP, STP, and OSTP 
development cycles is a daunting 
task. Rigorous control of changes 
and inputs must be maintained as 
the planners strive to produce, daily, 
a single integrated plan from which 


all ISS operations teams execute. 

The on-console flight control teams 
around the world document any 
modifications to the timeline from 
the Final STP in a Planning Product 
Change Request (PPCR). A web- 
based tool is used to generate, review, 
and implement the PPCRs. 

Figure 8 shows the PPCR tool 
summary interface. Each change 
request is assigned a tracking number 
based on the increment (i.e., 43-0541 
is the 541st change request during 
Increment 43) and indicates the 
title of the request, the flight control 
discipline authoring the request, the 
status of the request (e.g., Open, 
Implemented, or Withdrawn) along 
with an approval status matrix for 
the ISS control center participants. A 
PPCR is used to document changes 


to existing approved planning 
products. These changes include 
modifications or additions to a plan 
or changes to any details (e.g., start 
time, duration, procedure reference, 
execution notes, etc.) for an activity 
timeline. Specifically, PPCRs are 
generated to request or document 
changes from a Final WLP while 
in STP development, or to request 
changes to a Final STP. Changes 
affecting only a single partner require 
approval by the issuing partner and 
are provided to the other planning 
partners as “information only.” This 
allows each partner flexibility in 
planning without slowing the process. 
Other updates affecting crew time or 
integrated vehicle operations require 
approval by all international partners. 
For example, the Russian flight 
control team might need to adjust the 


SYSTEMS: INTERNATIONAL SPACE STATION PLANNING-A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 


11 









































































































































IMGO S— 0 

SPARTAN ETHOS OesPtla Sarc.'SME RIO EVA PoiMilM PLUTO 

CRONUS AO CO <JC CAPCOW OSO ROBO TOPO ISO 


PAO 

SPAN 


Weleoms 03. A/*tb«r v,hn« r«»d y for H/O on AFO 
POO COL ED MSG SPX-MD 
HSG-v J-FUGMT MTV TO CvoMO 


Ajnkar OrMA Rsfrs.h GUEST 


PPCR 


View PPCR Archive 


Refresh | [ Create Request Type | AM ~^] Dtietplins | AM Croups v] S«irch [ 


Tisirssil Itsmi/Pg | 39 v| > 



_ 








AIVCC 





Status 






43-0341 

Final STP for Monday, April 13 (GMT 103)/OKONHaTenbHMa STP (103 C8) 

Submitted: 097/2015 19:39 Source! LRP 

OfnPUn 

Open 

A 

O 

nr 

IR 

IR 

1° t 


43-0340 

US PL Changes for GMT 098 (ground) 

Submitted: 097/2013 19:17 Source! POICTCO 

POIC-TCO 

Open 

IR 

IR 

IR 

IR 

IR 

IO 

3 

43-0339 

US PL Changes for GMT 098 (CEO/IMAX) 

Submitted: 097/2013 10H7 POIC-TCO 

POIC-TCO 

Implemented 

A 

lO 

A 

xo 

IO 

IO 


43-0330 

US PL Changes to GMT 99-100 (Ground) 

Submitted: 097/2013 13:37 Sour.-!: POIC TCO 

POIC-TCO 

POO ... 

Open 

IR 

IO 

A 

IO 

IO 

IO 


43-0337 

[lis PL Changes for GMT 098 (crew) 

Submit!. 097/2013 18:31 POIC-TCO 

POIC-TCO 

Surgeon 

Open 

IR 

IR 

IR 

IR 

IR 

IO 


43-0330 

US PL Changes to GMT 99-101 

Submit,. ! 007/2015 14:27 Se«KMi POIC-TCO 

POIC-TCO 

POO 

Open 

IR 

IR 

A 

IR 

IR 

IO 


43-0333 

GMT 102 P1UV Rcconflg post 1B3/4B3 Battery Capacity Tests (Ground Only) 

Submitted; 097/2013 18:23 Source: SPARTAN 

SPARTAN 

Open 

IR 

IO 

IO 

IO 

IO 

IO 


43-0334 

BME Updates to GI4T 98 

Submitted: 097/2013 10:36 Source* BMC 

Surgeon 

Open 

IR 

IR 

IR 

IR 

IR 

to 


43-0333 

Delete extra WB placeholders on GMT 102 

Submitted: 097/2013 17:06 Source, ETHOS 

ETHOS 

Open 

IR 

IR 

IR 

IR 

IR 

IO 


43-0332 

GMT 099 - Populate WB placeholders with Condensate Pumping 

Submitted. 097/2015 02:20 Source! ETHOS 

ETHOS 

Ope" 

IR 

IR 

IR 

IR 

IR 

IO 


43-0331 

GMT 098 - Delete WSTA Fills (FE-S)//OTMe*HTv sano/menne WSTA a TCB 098 (BM-S) 

Submitted: 096/2013 13:39 Source, ETHOS 

ETHOS 

Open 

A 

A 

A 

IR 

A 

IO 


43-0330 

WPA Replan Part 2 GMT 100 

submitted: 097/2013 16:43 Source, LOP, OSO, OpsPtan 

OpsPtan 

OSO ... 

Open 

,R ! 

IR 

IR 

IR 

IR 

IO 


43-0339 

WPA Part 1 GMT 099///WPA, M.l TCB 099 

Submitted: 097/2013 16:02 Source, LOP. OSO, OpsPtan 

OpsPtan 

OSO 

Open 

; 

A 

O 

A 

IR 

A 

IO 


43-0329 

CRONUS Ground Updates GMT 100 

Submitted: 097/2013 14:39 CRONUS, ONC 

CRONUS 

Open 

_ 

V 

IO 

IR 

IO 

IO 

IO 


43-0327 

Delete Water Balance from GMT 102 (SPX Slip Cleanup) 

097/2013 13130 LOP 

OpsPtan 

Withdrawn 















V 

43-0320 

Modify ETHOS Ground activities GMT 100 

Submitted: 096/2013 17l41 Source, ETHOS 

ETHOS 

Implemented 

nr 

! _ 

IO 

IO 

IO 

IO 

IO 


43-0323 

US PL Changes for GMT 098 (ground and execution notes only) 

Submitted! 097/2013 14:07 Source, POIC-TCO 

POIC-TCO 

Open 

LL 

IO 

A 

IO 

IO 

IO 

- 

43-0324 

COL-CC changes to GMT098\ HiMeHettMt COL-CC Ha TCB098 

Submitted: 097/2013 14tl4 Source, CFN17862 

Col-OC/COP 

Pending 

A 

A 

A 

A 

A 

IO 


43-0323 

[ns Changes for GMT 098 

Submitted: 097/2013 14:01 RPT/A.VeRkiy 

RS Planner 

Pending 

A 

A 

A 

A 

,R 

IO 

3 

43-0322 

Crew changes to GMT098 (Crew: JEMAL T/S, 80 tasks) / H»t«tteMm achctbmm intnawa a TCB 098 ()kmuw: n 
096/201501:36 KIBOTT. ) PL AN(N103701E,#25,e 17), TCO, BME, OpsPtan 

JPtan 

Surgeon ... 

Open 

A 

A 

A 

A 

A 

to 

S> 

43-0321 

Modify OBT- ISS- EMER-SIM to remove outdated Reference document 

Sulmvited: 097/2013 13,32 Source, STL 

U! 

Impfamtnttd 

1 - - 

A 

IO 

to 

IO 

IO 

IO 

3 

43-0320 

Update execute notes for NOD1-STWG-PT2 on GMT 100 

Submit,-d: 097/2015 13:18 ISO 

ISO 

Implemented 

— 

A 

IO 

IO 

IO 

IO 

IO 

3 

43-0319 

RS Updates for GMT 102\ Pocomckmn sanpoc Ha hihcnchnc na 102 GMT 

Submitted: 097/2013 12:23 Source* ITI PC\ MtiuuptM M. 

RS-Ptenner 

Open 

A 

A 

IR 

IR 

,R 

IO 


43-0318 

COL-CC change to GMT100 (HOLD) 
submitted: 097/2013 11:16 Source. CFN17861 

Col-OC/COP 

Open 

IR 

IR 

IR 

IR 

A 

IO 

3 

43-0317 

Add SSC-WIRELESS-SLOW to GMT 100 

Submitted: 096/2013 14t36 Source, PLUTO, ChR 13261, PPCR 43-0468 

PLUTO 

I mpUnnofd 

NT 

!0 

IO 

IO 

E 

IO 

3 

43-0310 

BME changes to GMT 098\ Hihchchim [BME] Ha TCB 098 

Submitted: 096/2013 20,23 Source, BME 

Surgeon 

Implemented 

A 

A 

A 

A 

A 

IO 

3 

43-0313 

Use XTP for Rec Tk R&R on GMT 100 

Submitted: 096/2013 18,06 Source, ETHOS 

ETHOS 

Implemented 

A 

IO 

IO 

IO 

IO 

IO 


43-0314 

Ed.t 

Weekly Task List PPCR 

Submitted: 096/2013 23:17 Source, FCT 

OpsPtan 

etc... 

Open 

IR 

IO 

IO 

IO 

IO 

IO 

_ 


US PL Changes for GMT 098 (add rcmindcr)///AnepHKaHCKite hmchciwh no flH a TCB 098 (ao6*wt* htchhc h 

pnir-im 


nr 

i a 



rn 


Figure 8. A snapshot of the PPCR tool summary interface. The tool Web page assigns a tracking number in the left column (increment number followed 
by an incremental number of each PPCR), the title of the request, the discipline that submitted the request, and the current status of the request (Open, 
Implemented, or Withdrawn). The six columns to the right are labeled for each control center around the world. A PPCR may be indicated as Information 
Only (10) in that it doesn’t affect another partner’s activities but may be something the partner might want to know is occurring. Alternatively, a yellow 
In Review (IR) means the partners must evaluate and agree or disagree on its implementation. Once the control center agrees, the line item is marked as 
a green Approved (A). 


time during which a cosmonaut is to 
exercise on one of the pieces of shared 
exercise equipment. However, before 
the change can be implemented, the 
planners will verify that a US crew 
member is not already scheduled at 
that time or doing maintenance in that 
area. Changes are not accepted into 
planning products without a PPCR. 
The PPCR form includes specific 
information regarding the change 
description, rationale, source (e.g., an 


error in the information or a piece of 
equipment that is broken), resource 
requirements (e.g., power), scheduling 
constraints, and initiator. The LRP 
or OPS PLAN team assesses the 
feasibility or impact of implementing 
the change and provides feedback to 
the initiator as part of the approval 
process. For example, a flight control 
team or partner may want to add an 
activity to a crew member’s timeline, 
but the OPS PLAN team may find it 


would exceed the astronauts’ allowed 
workday length. The flight director 
at each control center grants final 
approval. Once a PPCR is approved 
for implementation, the LRP or 
OPS PLAN team, as applicable, 
implements the changes in the 
appropriate plan. The LRP and OPS 
PLAN teams routinely interface with 
the various elements of the MCC 
flight control team to solicit plan 
inputs, verify procedure references, 
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and coordinate replanning. This 
process continues around the clock, 

7 days a week; tweaks to the schedule, 
whether small or large, occur on a 
daily basis. 

The real-time OPS PLAN team is 
also responsible for reviewing and 
approving all messages to be uplinked 
daily for the crew’s Daily Execute 
Package. A significant part of the 
package is a Daily Summary. As 
the name implies, this part provides 
a high-level summary of notable 
activities and constraints (e.g., “The 
thruster will be fired at a specific time 
today, so ensure the window shutters 
are closed to prevent contamination.”) 
as well as follow-up questions to the 
crew (e.g., “Last week, a piece of 
hardware was reported broken. Can 
you please provide the serial number 
of the item?”) or answers to questions 
the crew had asked (e.g., “Can I move 
my exercise on Wednesday to later 
in the day?”). These messages also 
include procedure updates, activity 
overviews (e.g., a big-picture plan 
for an upcoming spacewalk), or 
system data. This is the final product 
generated by the planning team in 
preparation for plan execution. 

Changes to the plan that occur 
during the day of plan execution, 
due to anomalies encountered or for 
a variety of other reasons, are fed 
back into the planning process by the 
planners. Constraints for completing 
activities or urgency to implement 
new activities in response to system 
failures (e.g., exercise equipment 
breakage, toilet troubles, laptop 
failures, computer network problems, 
etc.) dictate how quickly plan changes 
need to be implemented. Again, the 
PPCR system is used to document 
these plan changes and work them 
into future plans. 


Scheduling Challenges 

During ISS operations, planners 
routinely grapple with a number of 
scheduling problems. For example, 
scheduling activities that need 
communications satellite coverage, 
managing resources and temporal 
relationships (e.g., Activity B must 
occur no earlier than 30 minutes after 
the end of Activity A), scheduling 
activities for globally distributed 
users, handling uncertainty in task 
duration, and wrestling with on¬ 
board stowage and worksite issues. 
Mission planners and crews continue 
to evolve the understanding of types 
of information the crews need and 
how to more effectively tie crews 
into the planning process during 
increment execution. 

Communication relay satellite 
scheduling can be especially 
challenging, given the complex nature 
of communications requirements, 
the competition for services with 
other users (e.g., the Hubble Space 
Telescope, the Department of 
Defense), and the uncertainties in 
coverage quality with variances in 
vehicle attitude. Science payloads, 
major events such as visiting 
vehicles dockings and undockings, 
spacewalks, and video events 
intended for the public generally all 
require using NASA’s Tracking and 
Data Relay Satellite (TDRS) (Ku- 
band for video and high-rate data 
transmission; S-band for voice and 
health and status telemetry. See also 
Chapter 13). The ISS planners make 
requests of TDRS services weeks in 
advance in competition with other 
TDRS users. Even uncertainties in 
vehicle attitude, which affects the 
ability of the radio antennae on the 
ISS to have the required direct line 
of sight to the TDRS, and where the 


solar arrays might be in their constant 
motion that sometimes can block the 
signal, may render a communication 
pass unusable. These factors make 
it difficult for planners to commit to 
specific times more than 1 week in 
advance for ISS TDRS service needs. 
Late changes may result in a lack of 
available TDRS time since service is 
scheduled on a first come, first served 
basis. If the ISS Program suddenly 
needs TDRS coverage—such as for 
an emergency spacewalk—the NASA 
flight director can declare the TDRS 
time as critical, thereby forcing 
other users off the network. Due to 
the impacts to other uses, which can 
include loss of science, this is not 
done unless absolutely required. 

Scheduling use of the exercise 
equipment is one of the bigger 
challenges in daily planning. Three 
main exercise devices are located 
on the USOS part of the ISS. These 
devices include Treadmill 2, a Cycle- 
Ergometer with Vibration Isolation 
System, and the Advanced Resistive 
Exercise Device. Crew members are 
required to exercise a minimum of 
2.5 hours per workday and follow 
strict exercise programs created by 
the medical team. Additionally, crew 
members often have preferences 
as to when they would like to 
exercise. Some crew members prefer 
to complete their exercise in the 
morning, others prefer to spread it 
throughout the day, and some like to 
perform their exercises in a particular 
order (e.g., aerobic followed by 
resistive). All six crew members must 
use the Advanced Resistive Exercise 
Device, thus compounding the 
planning. When a piece of exercise 
equipment breaks, a great deal of 
replanning is usually required until 
the equipment is repaired. 
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Planners also contend with sequences 
of activities where each activity 
requires the preceding one to be 
completed, sometimes with additional 
time between end and start. For 
example, the repair of a piece of 
equipment might require the ground 
control team to power the device off 
for a few hours before the astronaut 
performs the repair so that the device 
will cool down enough to be handled. 
Even gathering the tools for the repair 
has to be taken into account since, 
as with everything in microgravity, 
activities take longer than they do 
on Earth. The astronaut also must 
ensure that another crew member 
is not using the one item needed 
for the repair. Also, since every bit 
of available space is used to stow 
equipment or supplies, the equipment 
that needs to be repaired could be 
situated behind another object, which 
would need to be temporarily moved 
to another area. A simple repair 
can be tough to schedule with the 
addition of more temporal constraints 
such as the crew members’ desire to 
eat their meals together, which can 
be critical for psychological support 
when away from home and their 
usual routine for so long. 

Crew time is another limited resource 
that his highly constrained. Ground 
rules and constraints limit overall 
scheduled crew time per day to 
6.5 hours, with the remaining days’ 
time comprised of exercise (see 
above), sleep, morning and evening 
preparation (i.e., time to review the 
current or next day’s plan, review 
procedures to be used, etc.), and 
midday meal time. Further, the 
6.5-hour scheduled time is bounded 
by being allowed only after the 
morning crew/ground planning 
conference and needing to conclude 
by the start of the evening crew/ 
ground planning conference. The 


goal of managing crew time is to 
provide as much time as is practical 
for science scheduling. Science 
planners also contend with other 
limited resources such as batteries for 
small handheld devices, consumable 
gases (e.g., argon, nitrogen), water, 
test tubes, sample bags, test strips, 
etc., thereby further complicating 
the scheduling problem. Finally, 
planners must manage constraints 
imposed or required by the external 
environment such as day/night cycle 
requirements, attitude constraints, 
microgravity requirements, and 
satellite communications availability. 
Planners at the various ISS operations 
control centers manage many of their 
own resources as well as the use of 
common resources such as crew time, 
power, air, other gases (previously 
mentioned), tools, etc. To accomplish 
this, the planning teams use complex 
scheduling software to define and 
manage all these constraints and 
resources, and to generate valid 
effective timelines of crew and 
ground operations to support each 
day of ISS operations. Primary to its 
other tasks, the Houston flight control 
team, led by the ISS flight director, is 
responsible for integrating all these 
plans into a single, integrated plan 
that is presented in the OPTIMIS. 


Lessons Learned 

As previously mentioned, on-orbit 
crew time is at a premium. All efforts 
are made to minimize unnecessary 
use of this limited resource. One 
problem that all planners face is 
accurate prediction of task durations. 
Underestimating task duration leads 
to the replanning of uncompleted 
activities and, in many cases, requires 
crews to work longer hours to avoid 
getting too far behind the general 
plan. Planners usually arrive at task 


duration estimates through ground 
procedure verification and simulation, 
as well as through previous related 
experience, as described above. 

The time is usually increased to the 
predicted duration for new tasks 
or for astronauts executing a task 
for the first time on-orbit. In many 
cases, additional time is scheduled 
for crews to review procedures. A 
good example of this occurred during 
Expedition 1. The crew was asked to 
connect a newly flown control box to 
an on-board laptop to allow manual 
control of the Control Moment Gyros 
heaters (see Chapter 7) that had 
been experiencing extreme thermal 
fluctuations. Ground controllers, at 
the time, had no means to control 
the heaters. Upon reviewing the 
procedures on the ground, planners 
initially determined that 2.5 hours 
would be required for the astronauts 
to review the procedure and execute 
the task. The initial performance by 
the crew took 2.5 hours. However, 
subsequent performance only 
required 1.5 hours because of the 
familiarity gained with the apparatus 
and procedures. 

Early planners quickly learned 
the importance of accounting for 
the overhead involved in worksite 
preparation, equipment gathering, 
worksite cleanup, and equipment 
stow. A good example of this 
occurred during Expedition 4. The 
crew was asked to take samples of the 
US Laboratory Low and Moderate 
Temperature Loops (see Chapter 11) 
to check for microbial growth or 
particulate contamination. Ground 
task duration estimates predicted 
about 1 hour of crew time for the 
activity, including gathering the 
equipment. However, upon review 
of the procedure, the crew members 
pointed out that to access the loops, 
they would need to remove two 
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Arrival Departure 


Figure 9. Crew efficiency with time on orbit. Shortly after arrival, new increment astronauts need time 
to familiarize themselves with the location of items and how to live and work in microgravity. As the 
crew member gains more experience and acclimates, task efficiency increases. 


panels on which they had deployed 
and affixed several laptop computers 
and other general support equipment. 
Preparation of the worksite was then 
estimated to add at least 1 to 2 hours 
to the initial task prediction. This 
illustrated, to ground controllers and 
planners, the need to keep crews 
directly involved in the planning 
and replanning process as well as 
keep track of where everything on 
the ISS is located. Accounting for 
this additional overhead is especially 
important when scheduling the 
first couple of weeks of a newly 
arrived crew that is still in the 
adjustment phase. Maintaining a 
thorough inventory database and 
routinely providing time for crews to 
organize the habitat go a long way in 
minimizing the time needed to find 
equipment and organize worksites. 
The increased efficiency gained by 
the crew with time on orbit also helps 
the situation (Figure 9). Repetition 
of task execution, the experience of 
living in space, and the increased 


situation awareness gained by crews 
living and working in the same 
workspace for many months lead 
to efficiency in performing routine 
tasks as well as executing new tasks. 
By the end of an expedition, crew 
members are efficient in knowing 
the time required for task execution. 
Returning crew members (e.g., 
those who flew on the ISS during a 
previous expedition) have a much 
shorter learning or relearning curve to 
achieving peak efficiency. 

Not only is proper duration estimation 
and worksite preparation important 
to the success of the plan, it is very 
important for crew psychology. Early 
in the ISS Program, astronauts often 
exceeded the ground rule for the 
day length. A common complaint 
was poor estimation of task length 
(some of which was understandable 
since almost everything was “new”) 
and not enough time allocated for 
worksite preparation. During this 
early phase, astronauts often felt as if 
they were running a relay race. They 


didn’t want the team to fall behind, 
so they often worked extra hours to 
make up for problems or to perform 
extra science, as discussed above. 
That pace might have been acceptable 
for short-duration shuttle missions, 
which were about 2 weeks long; 
however, in addition to affecting 
sleep and performance, that pace 
can lead to burnout over a 6-month 
increment. The flight directors now 
manage the crew day much more 
carefully. This proved to be critical 
for the success of the yearlong 
increment of Scott Kelly and Mikhail 
Kornienko in 2015-2016. Pacing is 
necessary to maintain focus on the 
critical task of operating the ISS. 

Early on, it became evident to both 
the crew members and the planners 
that ISS crews need a bigger-picture 
view of the plan, along with a 
detailed daily timeline, to provide 
a sense of what is coming up and 
where the crew is headed. This helps 
improve success in two ways. First, 
from a psychology point of view, 
the detailed timeline helps crew 
members know how their daily tasks 
fit into the bigger picture and ensures 
that they feel part of the team. 

Second, it helps with efficiency. For 
example, if the crew members put 
tools away for a task but know a 
similar task will be performed the 
next day, they might temporarily 
stow the tools at the future worksite, 
thus saving time down the road. 

To this end, the OPS PLAN team 
developed a monthly calendar 
plan. This plan view is regularly 
updated, and is used as a basis for 
the Weekly Planning Conferences— 
i.e., a dedicated time each week 
where the OPS PLAN team for the 
increment discusses the upcoming 
week’s plan with the crew over the 
space-to-ground voice loops. Now, 
crew members are more frequently 


SYSTEMS: INTERNATIONAL SPACE STATION PLANNING-A ROADMAP TO GETTING IT ALL DONE CHAPTER 1 


15 










tied into replanning discussions to 
obtain the benefit of their situational 
awareness and experience. They are 
involved in the planning, even at 
the OOS stage. During increment 
execution, crew and ground operators 
conduct daily planning conferences. 
The morning conference focuses on 
describing unique supplementary 
information for that day’s schedule, 
whereas the evening conference 
concentrates on reviewing that day’s 
accomplishments and reviewing the 
next day’s detailed plan. 

An additional lesson learned from 
the Mir, Skylab, and early ISS flight 
planning experiences was that crew 
flexibility can lead to increased crew 
productivity. Crew timelines today 
include many activities marked as 
“flexible,” allowing crew members 
to perform them whenever they want 
during the day. These activities have 
no constraints (e.g., a strict deadline, 
or when resources such as power are 
needed). Allowing crew members 
to perform many of their routine 
activities such as exercise, the midday 
meal, and on-board training modules 
when it makes the most sense for 
them enhances productivity (e.g., 
multitasking). In addition, some 
astronauts—especially those who 
have flown to the ISS previously— 
may be more efficient in completing 
tasks than have been estimated by the 
ground for a “typical” crew member. 
Original ISS planning, which was 
based on Space Shuttle planning 
heritage, consisted of hard scheduled 
plans for the crew each day. These 
activities were to be performed in a 
linear fashion at prescribed times, 
thus leaving no option for flexibility 
based on crew situational awareness 
or multitasking. Derived from both 
Skylab and Mir, the notion of a 
“job jar” or “task list” of additional 


unconstrained activities folded into 
ISS operations planning. A task list 
activity is something that needs to 
be done at some point, but which 
doesn’t make it into the estimated 
time on a given day or week. If the 
astronauts get ahead on the timeline, 
which happens if the planning is 
done well and/or crew members are 
highly experienced, they may have a 
few minutes to complete one of these 
activities. Today, daily crew plans 
are highly populated with flexible 
activities and contain a robust task 
list. This shift in planning philosophy 
from more-optimized plans to more- 
flexible plans leads to more crew 
autonomy. Crew autonomy is seen as 
necessary for further crew exploration 
beyond low-Earth orbit or to Mars, 
where astronauts will be exposed to 
significant time delays and will thus 
be required to manage their plans 
and vehicle more autonomously from 
ground teams. The ISS has also seen 
an increase in crew productivity and 
efficiency with the expanded use of 
flexibility and task lists. 

The arrival of new crews to the 
ISS creates an opportunity for an 
operational dichotomy where new 
crew members, who are adjusting 
to life in space in an unfamiliar 
environment, are matched with a 
veteran ground team that operates at 
a high level of efficiency. To prevent 
this dichotomy, a throttling-back 
effect is imposed on the ground 
team while, at the same time, 
providing time for the on-board 
crew to acclimate. Through Gr&Cs, 
schedulable crew time during the 
first 2 weeks on orbit is reduced 
to permit time for adjustment and 
settling in. This allows the crew 
and ground to jointly arrive at an 
operations pace for the increment. 
This process is repeated with the 


start of each increment. However, 
considerations for particular crew 
complements to account for crew 
experience are made to increase ISS 
science returns. For example, the day 
after Peggy Whitson arrived for her 
second stay on the ISS, she called the 
ground team to report completion of 
all activities on her timeline as well 
as everything on the task list, and 
that she would appreciate additional 
tasks. Another complication is that 
the ground controllers, who work 
on weekly shifts, are not tied to 
specific crew arrivals and departures. 
As such, those ground controllers 
will achieve a level of efficiency 
independent from ISS crews. Lead 
flight controllers from every system 
are assigned to each increment to 
help mitigate this problem. Their task 
is to ensure uniformity from week to 
week for a given crew. 

Over time, the flight controllers and 
crew members have learned that 
staying synchronized is crucial, 
yet doing so non-intrusively is key. 
Asking a crew member repeatedly 
whether a task is done can get 
annoying. The OPTIMIS tool was 
modified to allow the crew to add 
crew notes (i.e., brief messages to 
the ground) in each activity, which 
will provide additional information 
about the execution of a particular 
activity (e.g., stowage information 
after completing a task, equipment- 
identifying information such as 
serial numbers or barcode numbers, 
or comments about the execution 
of an activity—how long it really 
took, procedure issues encountered, 
etc.). The flight controllers and 
crew found that this nonverbal 
means of communicating certain 
information, as mentioned above, 
is highly effective and frees up the 
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space-to-ground channels for more 
important conversations. 

Following the conclusion of an 
increment/expedition, mission 
planners, through the Lead Ops 
Planner, work with the ISS 
Program operations team to 
reflect overall increment metrics 
of accomplishments in the Post 
Increment Evaluation Report. 
Additionally, the lead increment flight 
director conducts a lessons-leamed 
meeting to roll up significant topics 
that need to be either generically 
addressed for all future increments 
or unique items that need to be fed 
into the next increment’s execution 
team. In many cases, planners provide 
lessons learned on activity duration 
estimations (based on crew feedback) 
as well as lessons learned on activity 
planning conflict resolution. The 
aim is to keep the ISS safe for crew 
operations while continuing to make 
operations more efficient to support 
the goal of greater scientific gains. 

Conclusion 

Flight planning has been a necessary 
yet ultimately challenging task since 
the beginning of the space program. 
Each mission that NASA performed 
brought its own unique planning 
and scheduling challenges, which 
were met by planners using the latest 
technology of the day. Planners 
continue to meet these with a credo 
of flexibility and a constant eye 
toward improvement. Unlike other 
NASA projects, the ISS Program 
involves a worldwide team working 
24/7/365. Plans for every activity 
that takes place on the ISS start years 
out and are continuously refined in 
detail as the actual time approaches. 
This ensures maximum success and 


minimal wasted time. Planning was 
difficult during assembly of the ISS 
due to constant changes. Some of 
these changes were necessary to 
the evolving vehicle, whereas some 
were induced by the Space Shuttle 
Columbia accident and concentrated 
on the vehicle build-up. In 2009, the 
ISS increased from three permanent 
crew members to six, and began 
the shift in focus from assembly to 
science. Starting in 2018, commercial 
crew vehicles will add further 
complexity as the rate of scientific 
operations increases with a permanent 
crew of seven. 
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Chapter 2 Day in the Life: 

Living and Working 
in Space and 
on the Ground 




The first six-person crew—Increment 20 in 2009—included astronauts and cosmonauts from all international partner agencies for the first (and, so far, 
the only) time. From left: Canadian Bob Thirsk, European Frank De Winne, Russian Gennady Padalka, Russian Roman Romanenko, Japanese Koichi Wakata, 
and American Michael Barratt. 


The International Space Station 
(ISS) is a hub of never-ending 
activity, around the dock, around 
the world, every day On board 
the orbiting laboratory, the crew 
members are not only the laboratory 
technicians, they also keep the facility 
up and running by working as janitors, 
plumbers, electricians, information 
technology support, medics, kitchen 
crew, and housekeeping. They manage 
the arrival of vehicles delivering 
new crew, new equipment, and 
additional supplies, as well as the 
departure of vehicles returning crew 
and equipment to Earth or disposing 
of trash. They are responsible for 
completing any necessary repairs or 
reconfiguration that cannot be done 


by simply changing parameters in 
software. On the ground, the flight 
control teams—both on console and 
off—support the increment as a whole 
by working between control centers 
and management teams around the 
globe to keep the crew safe, keep 
the ISS running smoothly, and meet 
all mission objectives. Together, the 
on-board crew and the ground teams 
respond to problems, incorporate new 
priorities, and adapt the mission plan 
as conditions change—sometimes on 
a daily basis. 

Crew rotation flights are currently 
done using Soyuz vehicles, 
launched by the Russian Space 
Agency Roscosmos from Baikonur, 
Kazakhstan. A Soyuz can fly up to 


three crew members, and can stay on 
orbit and docked to the ISS for about 
6 months, where it is available as a 
“lifeboat” to return the crew to Earth 
in the event of an emergency. Four 
Soyuz crews have been flown each 
year since 2009, maintaining a total 
crew of six people on board the ISS 
most of the time. Prior to 2009, the 
ISS had a permanent crew of three 
people, with two Soyuz launches 
per year. The launches take place 
approximately every 2-4 months. 
Usually, flights are arranged in a 
pattern of “indirect handovers”: one 
Soyuz will undock just before launch 
of the next, so the crew goes from six 
people on board down to three, and 
back up to six when the next Soyuz 
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arrives. The pattern of launches and 
the number of crew members on 
board at any time will change when 
the new commercial crew vehicles 
being built by the United States are 
ready to rotate crews around 2019 
(see Chapter 14). 

ISS operations are managed in periods 
called increments, which are defined 
by the on-board crew complement: 
an increment is the period of time in 
which a dedicated crew of astronauts 
and cosmonauts are on board the ISS 
under a specific commander. Each 
new increment begins when one 
commander hands over to another 
before departing the ISS. Before 2009, 
each increment lasted approximately 
6 months - the full duration of each 
Soyuz crew’s stay on orbit. Today, 
each increment corresponds to the 
period of overlap between two Soyuz 
crews, so each increment lasts about 
2-4 months, and each ISS crew 
member serves on two increments. 

As discussed in Chapter 1, 
preparation for flight begins years 
in advance. A team of flight 
controllers is assigned to manage 
the increment. Depending on each 
discipline’s involvement in crew 
training and mission planning, flight 
controller assignment may happen 
a year or two before the increment 
begins. A lead flight director is 
assigned to manage this team and 
lead the overall operational mission 
integration and preparation. The flight 
control team follows the six crew 
members through their final training 
as they transition from generic skills 
to lessons more closely tailored to the 
specific tasks and research that will 
be performed during their time on 
orbit. The two different Soyuz crews 
will launch 2 to 4 months apart, 
and each will be part of two 
increments. Therefore, each crew 
may work with two different lead 


flight directors and teams during its 
time on board the ISS. 

This chapter describes how the team 
of flight controllers in Houston, 
Texas, their international partner 
counterparts around the world, 
and the ISS Program, engineering, 
safety, and medical support teams 
work together to manage day-to-day 
operations of the most complicated 
international laboratory ever built. 

Before the Crew Reaches 
Space 

Mission integration and preparation 
is organized through a Joint 
Operations Panel (JOP), chaired 
by the increment lead flight 
director. All of the assigned flight 
controllers, instructors, ISS Program 
representatives, engineering and 
safety team members, along with 
partner teams supporting payload 
operations and international partner 
teams are members of the JOP. This 


team will review new operations, 
priority adjustments or requests from 
ISS Program management, new 
candidates for complex tasks such as 
extravehicular activities (EVAs) or 
vehicle relocations from one docking 
port to another, and new data on ISS 
systems performance. 

The team also reviews any significant 
changes being made to crew training 
and, in some cases, participates 
in the actual training events. For 
example, each crew of six holds one 
emergency scenarios training event 
during a time when both sets of three 
crew members are in Houston. The 
lead flight director, along with his or 
her lead training team, will observe 
the event (Figure 1). 

The flight director and flight 
controllers assigned to lead that 
activity might also observe other 
significant training events, such as 
EVA training in the Neutral Buoyancy 
Laboratory or rendezvous training on 
the simulator for visiting vehicles. 
Flight control team members take 



Figure 1 . Expedition 49 astronauts and cosmonauts discuss an emergency scenario exercise with 
the training team and the lead flight director. From left to right: Andrei Borisenko, Interpreter Ksenia 
Shelkova, Sergey Ryzhikov, Shane Kimbrough, instructors Amy Holloway-Margiolos (standing), Bobby 
Fard, and Elisca Hicks, and Flight Director Amit Kshatriya (standing). 
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every opportunity to make sure 
they understand the crew members’ 
perspective and how they work 
together in complex operations and 
critical scenarios. 

In the month leading up to the 
beginning of the increment, the 
various teams within NASA and at the 
international partner agencies conduct 
a series of Flight Readiness Reviews, 
culminating with a final review led by 
NASA Associate Administrator for 
Human Exploration and Operations 
William Gerstenmaier. At this review, 
the ISS Program and all supporting 
teams confirm readiness for the 
beginning of the new increment, the 
landing of the Soyuz with the current 
ISS commander and crew, and the 
launch of the next Soyuz. 

Three weeks before the increment 
begins, the real-time process “kicks 
in” for mission planning. At this 
point, the increment team starts to 
participate in day-to-day planning 
and integration in Mission Control. 
About 1 week before launch, most of 
the planning process is being done for 
the new increment. By the time the 
new ISS commander has taken charge 
on board, the increment lead flight 
director and his or her team is well 
and truly installed in Mission Control. 

A Day in Space—and on 
the Ground 

At about 7:30 a.m. (0730 Greenwich 
Mean Time [GMT]), flight control 
teams in Houston, Huntsville, 
Munich, Tsukuba, and Moscow 
wait for the ISS commander to make 
the call that marks the official start 
of the workday for the crew on 
board the ISS: 

“Houston, Station—good morning! 
We are ready for the morning DPC.” 


Each morning’s Daily Planning 
Conference (DPC) gives the flight 
control teams a chance to ask 
questions and provide any late- 
breaking news or updates to the plan 
for the day. Houston starts things 
off with general items and anything 
related to core US Segment systems. 
If needed, the other four United 
States On-orbit Segment (USOS) 
centers take their turns: Huntsville for 
the NASA experiments and related 
systems; Munich for the Columbus 
module and European Space Agency 
experiments; and Tsukuba for the 
Kibo module and Japan Aerospace 
Exploration Agency experiments. All 
of these conversations are in English. 
Once the USOS operations have 
been covered, it is Moscow’s turn to 
address anything related to Russian 


Segment systems and experiment 
operations. This part of the 
conference is in Russian. The whole 
morning DPC may take anywhere 
from 2 to 15 minutes, depending on 
the complexity of that day’s plan. 

By the time this conference takes 
place, the crew members have been 
awake for about 1.5 hours. That 
early morning time is set aside for 
their normal waking-up routines, 
creatively labeled “post sleep” on 
the crew’s timeline. They also look 
at the ISS version of the morning 
news: a message sent up every 
workday and once per weekend 
called the Daily Summary, which 
is used to ask/answer questions and 
provide key pieces of data that might 
be too detailed or too repetitive to 


Synchronizing All Watches 

“Morning,” to the crew, has nothing to do with sunrise. The ISS orbits the 
Earth once every 90 minutes, thus the crew sees the sun rise and set every 
hour and a half—that’s 15 or 16 times each day. Instead, a common time 
zone needed to be selected so that the crew—and all of the teams on 
Earth —are on the same clock. The ISS Program picked Greenwich Mean 
Time (GMT), also known as Coordinated Universal Time (UTC) or “Zulu” 
time. The crew gets up at about 0600 GMT, starts work around 0800, 
ends the workday at about 1700 GMT, and goes to bed at 2130 GMT. 

This means the crew’s workday most closely lines up with the Columbus 
Control Center workday in Munich, with Moscow just a couple hours 
ahead. For the Kibo team in Tsukuba, the crew’s workday begins in late 
afternoon, while for Houston and Huntsville, crew members wake up in 
the middle of the ground controller’s night. Although flight control teams 
are on console in all those locations, 24 hours every day, the teams tend 
to plan complex or intensive activities to line up, as much as possible, 
with local working hours. This applies especially when it comes to major 
systems maintenance or assembly of new equipment—i.e., activities that 
might need extra support from specialist engineering or support teams. 
Thus, major Kibo, Columbus, and Russian Segment systems work tends 
to be scheduled in the crew morning, while NASA tends to schedule major 
work on its systems, or in its modules, later in the crew day. Science 
activities and related support work are scheduled throughout the day for 
investigative teams around the world. 
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Figure 2. Flight Engineer Kjell Lindgren is photographed in the US Laboratory as he prepares one of the lockers for installation of the Common 
Communications for Visiting Vehicle hardware that will be used by the new commercial crew vehicles (Chapter 14). 


talk through in the morning DPC. 
On some mornings, crew members 
are also busy with life sciences 
and medical data collection—e.g., 
drawing blood samples, etc.—in 
which case some post-sleep time is 
blocked for them after DPC to make 
up for their early activities. 

Once the DPC is complete, the 
crew day begins. A video camera is 
turned on, and is usually in the US 
Laboratory module, Destiny, which 
is generally a thoroughfare for most 
of the crew. If science or other work 
is planned in other modules, cameras 
will be used in those places, as well. 
The ability to see the crew members, 
sometimes looking “over their 
shoulder” to follow their activities, 
helps the team on the ground 
understand the situation on board, 
anticipate questions, and turn around 
answers more effectively (Figure 2). 


But the video is treated with special 
care. After all, the ISS is not just 
a laboratory: it is where the crew 
members live. Cameras are not used 
outside their scheduled working week, 
or in areas where a private activity 
such as a family conference, medical 
checkup, or exercise is taking place. 

Morning DPC occurs around 
1:30 a.m. in Houston—basically 
in the middle of the night for the 
flight controllers. Mission Control 
is quiet at this hour. Usually, only 
the flight director, core systems 
team, and any specialists needed to 
support the crew’s morning activities 
are on console. On a good day, 
the increment team is at home and 
asleep. As the increment team starts 
to wake up in Houston—around 
the crew’s lunchtime—they start 
checking in with the real-time team 
to see how things are going. Unless 


they got called in overnight for a 
problem, or came in early to watch 
a particular activity, the increment 
lead flight controllers will start by 
reading their discipline’s console 
logs from the past few shifts. This 
tells them what has happened in their 
system, maybe what agreements have 
been reached with their international 
partner counterparts, or what 
questions have come up from the 
crew or other team members. Some 
mornings, everything checks out as 
expected. However, most of the time, 
something unexpected is documented 
in the logs or on the crew’s timeline, 
which means the flight controller’s 
first order of business will be to 
figure out what went wrong, or what 
needs to be replanned. 

The increment lead flight director also 
hits the ground running by reading 
the console logs. He or she checks 
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Figure 3. Lead Increment 44 Flight Director Michael Lammers works in the Flight Director’s Suite, a small 
office that overlooks the ISS Mission Control room in Houston. 


in with other team members and ISS 
organizations as appropriate, given 
that day’s activities (Figure 3). Then 
the meetings begin, sometimes as 
early as 6:00 a.m., Houston time. 

The ISS Mission Management 
Team (IMMT) meets twice a 
week. The IMMT is chaired by 
by the ISS Operations Integration 
Manager Kenneth Todd and includes 
representatives from each of the 
international partner agencies, and 
from all offices within NASA’s ISS 
Program as well as flight operations, 
safety, engineering, and health 
and medical. The IMMT approves 
mission priorities and real-time 
Flight Rule changes and waivers, and 
conducts final readiness reviews for 
major activities including launches, 
dockings, landings, and EVAs, 
and dispositions major anomaly 
investigations. The chairperson 
usually conducts a series of one- 
on-one tag ups with various partner 
agencies and commercial vehicle 
teams before each IMMT. The 
increment lead flight director supports 


the process, as well. Twice a week, the 
NASA team meets internally with the 
ISS Operations integration manager at 
an operations tag up for more focused 
review of NASA internal topics, 
sometimes in preparation for an 
upcoming IMMT presentation to the 
rest of the partnership. Owing to the 
continuous operation of the ISS and 
the complexity of the systems, daily 
meetings between the operations team, 
the engineering support team, and the 
integration manager normally occur in 
between these more formal reviews. 

In parallel, the crew continues to 
follow the timeline. Each crew 
member is scheduled for two daily 
exercise sessions (Figure 4). The 
ISS has two treadmills and two 
stationary bikes— one of each in the 
Russian Segment and US Segment. 
The equipment also includes one 
resistive exercise system for strength 
training. Managing to get all six crew 
members scheduled for the exercise 
they need without double-booking 
the associated equipment can be a 
tricky planning problem, particularly 


on days when maintenance is needed 
on any of the exercise equipment, or 
even on other systems nearby. 

One hour of each crew member’s day 
is set aside for the “midday meal.” 
Attempts are made to line these up 
for all, or most, of the crew. The crew 
members can use this time as they 
see fit. This is a chance for them to 
take a break during a busy day, grab 
a bite to eat, and maybe hang out 
with their crewmates for a bit before 
getting into the afternoon schedule. 
Aligning the times for the entire crew 
also provides psychological support 
for long missions away from friends 
and family. 

As the afternoon progresses, the 
ground teams—in addition to 
following along with the crew 
members as they work through the 
timeline—are reviewing and updating 
the next day’s plan. The goal is to get 
an updated version on board before 
about 1730 GMT so that it is on board 
when the evening DPC takes place 
about an hour later. The evening DPC 
starts with a crew call to Houston, as 
with the morning DPC. The calls then 
go around the world to control teams 
again for any comments, questions, 
answers, and last-minute bits of news 
from the day, ending with Moscow. 

As soon as the DPC concludes, the 
crew’s workday is officially over. 

All interior camera views are turned 
off to provide the astronauts privacy 
during their “evening” time. Except 
for occasional conferences or short 
research activities, the crew’s evening 
is marked “presleep” on the timeline, 
followed by a 9.5-hour stretch marked 
“sleep.” NASA does not track how 
they use that time, and no one calls 
the crew members or otherwise 
disturbs them unless their help is 
needed right away to deal with a 
major problem on board. 
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Figure 4. Expedition 7 (July 8,2003) Science Officer Ed Lu exercises on a Cycle Ergometer Vibration 
Isolation System in the US Laboratory Each crew member is scheduled for two exercise sessions per day 


The workday never really ends for 
the flight control teams. Most of 
the teams—Houston, Huntsville, 
Munich, Tsukuba—split the day into 
three shifts of 9 hours, with an hour 


of overlap for the teams to hand over. 
In Moscow, the flight control team 
works a full 24-hour shift, handing 
over just before morning DPC, at the 
start of the workday in Moscow. 


The flight control teams on console 
are responsible for putting together 
the detailed timelines for the 
upcoming 7 days based on ISS 
Program requirements and direction 
from the increment flight control 
team. As discussed above, before 
the end of each crew workday, the 
ground teams will review and discuss 
any major changes for the next day’s 
timeline so that the crew can be 
informed as to what will be discussed 
during the evening DPC. The team 
may make additional changes while 
the crew sleeps, or may simply 
“fill in the blanks” by attaching 
procedures and messages to provide 
all the detail the crew and flight 
control teams will need to execute 
the timeline. The console team 
also typically reviews and updates 
the “3-day-out” and “7-day-out” 
timelines each day, so that they are 
continually looking ahead a few days 
to make sure all the details needed 
to complete each day’s objectives 
are captured in the plan. A standard 
process described in Chapter 1, 
with milestones throughout each 
24-hour day and 7-day week, allows 
all of the control teams a chance 
to make inputs to each plan review 
before the final timeline approved 
and put on board for execution. 

The detailed plan for the day might 
not be finalized until a few hours 
before the crew awakens, even if the 
major objectives for that day were 
selected weeks, or even months, 
ahead of time. 

The increment lead flight controllers 
continue to hold JOPs as well, now 
focusing on assuring all details 
needed to support planned operations 
are ready to go, including the 
procedures, flight rules, analysis, 
and any associated agreements 
with international partners or 
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Figure 5. The Increment 40 JOP, working in Mission Control Center Houston, reviews current and future activities, and coordinates all the key elements 
between the engineering and science teams as well as the international partners. 


commercial providers (Figure 5). It 
may take quite a bit of coordination 
and detailed development work to 
put the procedures and supporting 
material together as well as testing 
or simulating the process before 
a specific operation. The JOP 
coordinates that work, and the 
individual lead flight controllers spend 
most of their days building those 
detailed products for final review and 
approval before they get attached 
to the appropriate plan. Although 
many activities have become routine, 
the dynamic and evolving nature of 
the ISS necessitates the continuous 
development or modification of 
many procedures. 

The increment team, meanwhile, is 
looking out at the weeks ahead, and 
working to find homes for all the 
activities that the ISS partnership has 
agreed are priorities for this mission. 
This is an ongoing process. The 
increment manager, representatives 
of the ISS Program office that 
ensure the right activities are being 


performed, and their team in the 
Increment Management Center 
regularly review the Increment 
Requirements Definition Document 
(see Chapter 1). Those priorities 
are allocated to different stages in 


the increment via the Current Stage 
Requirements Document, which 
breaks down the 6-month Increment 
Requirements Definition Document 
period into the stages defined 
between major mission events— 



Figure 6. Increment 44 Lead Flight Director Mike Lammers (sitting) discusses crew activities with 
fellow Russian Flight Director Alexei Buchilin (far right) and his interpreter Paul Kharmats. The Russian 
Space Agency houses several of its team members as part of the Moscow Support Group in Houston, 
while a number of NASA flight controllers work in Moscow as part of the Houston Support Group. 

See also the Introduction. 


26 


CHAPTER 2 DAY IN THE LIFE: LIVING AND WORKING IN SPACE AND ON THE GROUND 


Photo courtesy of Robert. C Dempsey 

























Figure 7. The crew shares a meal in the Node 1 during Christmas 2009. From left to right: 
Japanese astronaut Soichi Noguchi, cosmonauts Maxim Suraev and Oleg Kotov, and American 
astronauts T. J. Creamer and Jeffrey Williams (commander). 


usually vehicle launches or landings. 
The increment lead planning team 
then works the stage priorities into 
upcoming weekly plans. Once a 
week, the increment lead flight 
director and the whole team review 
the next 3 weeks in the Weekly Plan 
Review. Crew activities are assigned, 
crew workday durations are tallied 
up, task list items (“job jar” activities 
that can be completed any time the 
crew is free), and off-duty days or 
holidays are planned at this meeting. 
In addition, recent trends on system 
performance, consumables usage, 
and upcoming vehicle traffic are 
accounted for, and associated on¬ 
board activities may be adjusted. 

In between meetings, the lead flight 
director, who is set up in an office in 
Mission Control (Figure 6), works 
with all their counterparts, flight 
control team members, and ISS 
Program cohorts to address issues 
and develop future priorities and 
plans. On any given day, the flight 
director may be working with people 
who are down the hall, in the next 
building, halfway around the world, 
or just one time-zone away. 

Time Off, Conferences, 
and Celebrations 

Unlike a Space Shuttle mission that 
would last about 2 weeks at most, 
an increment mission lasting 6 
months is a long time and therefore 
the crew members need time off 
to prevent them from burning out. 
Each expedition crew agrees upon 
its holiday schedule prior to flight. 
The crews need to decide this 
together, since different countries 
celebrate different holidays. Each 
Soyuz crew gets about four holidays 
during their 6-month stay. Some 
crews end up celebrating both the 
Eastern and Western Christmas 


holidays (Figure 7). When those 
holidays are also celebrated in one or 
more of the partner Mission Control 
Centers (MCCs), those teams get 
to help the crew celebrate, and vice 
versa. Sometimes, crew members 
send food to Mission Control via 
Earth-based friends and family. The 
flight controllers will sometimes put 
together a special message for the 
crew, or uplink video views from 
inside MCC to say “hello.” These 
activities help keep morale high both 
for the crew members, who are totally 
isolated on the ISS, and the flight 
controllers, who have to spend long 
hours away from families during the 
holidays to support operations. 

In addition to holidays, crew 
members receive regular time off. 
They generally work Monday 
through Friday, and have Saturday 
and Sunday mostly to themselves. 
Some time may be scheduled for 
short stretches of work—e.g., routine 
systems maintenance, housekeeping 


and cleaning, science or medical 
sample collection—but on a normal 
weekend, this time is limited to an 
hour or so each day. 

What do ISS crew members do with 
time off? Yes, they have television - 
when the ISS has a communication 
link with the ground, MCC can route 
video to an on-board computer. 
Limited bandwidth means only a 
couple of feeds can be sent at a time, 
though, and MCC is in charge of 
changing the channel. They have 
internet access—not fast, and not 
all the time, but they can tweet or 
surf a bit. They can choose from an 
impressive stash of digital videos 
(mostly movies) on board. The 
stash gets refreshed periodically— 
sometimes with releases that have 
yet to reach theaters. Many crew 
members bring up supplies for their 
own hobbies. For example, the ISS 
has established quite a collection of 
musical instruments over the years. 
Models have been assembled, quilts 
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Figure 8. Examples of free time for the space station crews. Top: Dan Burbank, Expedition 30 
commander, plays a guitar in the US Laboratory on December 16,2011. Bottom: Expedition 45 crew 
members watch an advance screening of the movie The Martian in the Unity Node 1. Clockwise 
from left: Flight Engineer Oleg Kononenko, Flight Engineer Sergei Volkov, Commander Scott Kelly, and 
Flight Engineer Mikhail Kornienko. 


have been pieced, and art has been 
made on board the ISS. See Figure 8. 

The crew schedules conferences 
every week with various folks on the 
ground, for work and for personal 
contact. Private video conferences for 
each crew member with their family 
are scheduled every weekend. Each 
week, every crew member has a one- 
on-one video conference with his or 
her flight surgeon who monitors that 
crew member’s health. Periodically, 
the ISS Program manager and chief 
of NASA’s Astronaut Office schedule 
conferences with each crew member 
to check in with them directly. Each 
crew member can also organize a few 
special conferences with whomever he 
or she chooses while on board the ISS. 

Crew members can make phone 
calls via laptop—i.e., “voice-over 
internet protocol” (see Chapter 13)— 
and through that means can contact 
family, friends, and colleagues any 
time the ISS has the right kind of 
communications link to the ground. 
There is nothing quite like the 
surprise of that first phone call from 
space, and it provides a huge morale 
boost to both the crew and the flight 
control team to be able to have such a 
direct line of communication. 

At the end of each working week, 
NASA’s lead flight director and the 
lead Russian shift flight director 
hold their own conferences with 
the crew. These are often “working 
discussions” where the ground teams 
fill the crew in on any developments 
regarding upcoming launches, 
program decisions, or new activities, 
and can answer questions about 
any issues being tracked or worked 
for the increment. It also is a time 
for the crew and ground to relax and 
unwind with some good-natured 
kibitzing. In addition, since the flight 
directors often act as advocates for 


the crew with the rest of the ground 
teams, these conferences are one 
way for them to stay in sync with 
each other on issues or concerns. 

It can also be a good chance for 
team building. When a complicated 
maintenance activity is coming up, 
for example, the flight director might 
invite the Operations Support Officer 
or the hardware owner (or both) to 
come talk to the crew members in 


case they have questions about the 
procedures. When crew members 
from other international partner 
agencies are on board, those teams 
will hold a weekly conference with 
their crew members, as well. Finally, 
special working conferences will be 
scheduled to help the crew prepare 
for some complex operations, such as 
complicated maintenance procedures, 
EVAs, or visiting vehicle operations. 
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Chasing the Red Line 

Sunita Williams, Expeditions 14/15 and 32/33 

Every day is different, but they all have one thing in 
common: the Red Line, which is either chasing you or you 
are chasing it (see Chapter 1, Figure 7). All activities are 
planned out—even exercising (mainly to accommodate all 
the crew members on the limited equipment). But that’s 
okay, because there is no way one individual could think 
of all the things that need to be done, or prioritize them. 

The main categories of activities are science, 
maintenance, public relations and outreach events, and 
robotics and spacewalks; however, the categories also 
include installation of new or upgraded modules and 
systems, since the things need to be fixed or added on 
the inside and outside as the ISS continues to evolve. 

The activity subject matter can range from the mundane 
to the incredibly complicated. In any given week, you 
could be updating the on-board computers, setting up 
tools for a spacewalk, practicing grappling a free-flyer 
spacecraft, fixing the toilet, fixing the water system, 
inventorying food and supplies, sequencing DNA, setting 
up for fire experiments, taking your own blood samples, 
making contacts through Ham radio, and talking to the 
NASA administrator, a Queen, or even the President of the 
United States! The science never stops up here—we are 
in microgravity and we can’t escape. Even cool science 
experiments have mundane aspects, such as when we 
had to clean the aquarium and remove air bubbles— 
which, ironically, could kill the fish in weightlessness—for 
some Medaka fish we were studying. Of course, we need 
to plan time for exercise, eating, and hygiene as well. 

Whether I had two other crewmates, such as on my first 
expedition, or five as I did on my second visit, one key 
element was that everyone has a great sense of humor, 
even with all the different personalities. Humor is essential 
to living in an environment like this. 

We are always interacting with the people in Mission 
Control. They are our team, our family. Our mood on the 
ISS can dictate their mood in Mission Control. Likewise, 
their mood in Mission Control can dictate our mood on the 
ISS. We are symbiotic by the nature of our work together 


on this complex and extraordinary station in space. 
Mission Control watches our backs every night as they 
monitor the station system. This allows us all to sleep on 
the same schedule, thereby making us a stronger team. 

On the ISS, we have to monitor ourselves and our 
psychological health, as well as our physical health. 

You can work all the time, but everyone needs a break. 
Everyone needs a reserve in case of an emergency in 
the middle of the night. To function normally, the space 
station runs on a regular Earth workweek and workday. 

We emphasize taking a break for lunch, but each person 
needs to think ahead and plan his or her next meal. Some 
of it needs to be hydrated or heated up, which takes time 
for the water absorption. Best not to rush these things. 

So, in the process of grabbing a bag of coffee and heating 
up veggie quiche, we usually put some food in the heater 
to be ready for lunchtime. The Russian food is generally 
some type of meat with rice, noodles, and kasha, which is 
best heated up. It’s hearty food! Part of the fun is seeing 
what is available to eat. We eat out of a box for 10 days 
or so. We don’t open another box until that box is done. 
So, the philosophy was not to save something, because 
someone else will eat it. Eat what you think is best that 
day. There will be a new best thing the next day. 

Often on the weekend, we try to have a family dinner 
where everyone pitches in. We would all get our special 
food and spread it out on our table. One time, we had 
Azman’s sausages—something I was able to import from 
Cleveland —cooked and sliced. Yum! Everyone loved 
them. I was only able to save a couple for later. We had 
corn tortilla chips with bean dip and jalapenos. One of 
the very special packages we received from a recent 
Progress flight included fresh garlic, lemons, apples, and 
grapefruits fresh from Kazakhstan! Food and friendship 
are all part of the maintaining our health —both physical 
and psychological. 

Luckily, exercise is part of our daily routine, and it is a 
great stress reliever. Most folks also have space hobbies 
that help them deal with stress—hobbies such as being 
in contact with friends and family at home through the 
IP phone or net meetings, doing self-designed science 
experiments, taking videos and pictures, writing in a 
journal, doing social media, etc. 
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Complex Operations 

Many days are anything but normal. 
A vehicle launch and rendezvous, a 
spacewalk, a failure on board—all 
these events can rearrange the crew’s 
working schedule, and require the 
attention of a lot more specialists 
on the ground. Most of the time, a 
separate lead flight director and a 
team of lead flight controllers and 
other specialists are assigned to that 
specific activity. This lead team 
coordinates with the increment team 
to make sure it is clear who will 
do which tasks to prepare for and 
execute the operation, and how the 
right team members will coordinate 
with the on-board ISS crew. 

Planning an EVA is a complex 
task for the ISS team and crew. 

When everyone involved knows 
far in advance that an increment 
will include a spacewalk, and the 


tasks for that spacewalk are well- 
defined, the crew members can train 
on those tasks before they launch, 
and the flight controllers building 
the EVA plan can account for their 
specific experiences in training, 
preferences, etc., as they put together 
the final plan and procedures for the 
EVA. Many times, however, one 
or more spacewalks were added to 
an increment to deal with failure 
of critical hardware. Although 
all EVA-certified astronauts get 
preflight training on the significant 
tasks involved in critical hardware 
replacement or repair, in such cases 
the flight control team does not 
have a specific EVA timeline to 
walk the crew through preflight. 

Once the failure occurs, the flight 
control team starts planning the 
recovery spacewalk(s), and builds the 
associated procedures and timelines 
for the crew. This is typically done 


via Team 4, which is described in 
more detail in Chapter 20. A flight 
director is assigned to manage that 
effort and lead the team that will 
support the EVA. This team will 
coordinate with the increment lead 
flight director to make sure all the 
preparation and recovery tasks can 
be integrated into the increment plan, 
which is then brought to the IMMT 
for final approval (Figure 9). 

On the day of the spacewalk, the 
designated crew members spend 
several hours getting suited up and 
ready to go outside. Once in their 
suits, they execute a sequence of 
steps to safely depressurize the 
airlock so they can open the hatch 
and go outside. An EVA timeline is 
carefully choreographed ahead of 
time, and the team on the ground is 
supporting the crew literally every 
step of the way up to and during the 
spacewalk to respond to issues or 



Figure 9. The Expedition 46 Team 4 flight controllers discuss how to repair the stranded Mobile Transporter in a meeting of the IMMT on December 18,2015. 
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Back to Earth 



Figure 10. NASA Flight Director Dina Contella monitors the launch and docking of the Expedition 
46/47 crew (Yuri Malenchenko, Tim Kopra, Tim Peake) on Soyuz from the Baikonur Cosmodrome in 
Kazakhstan on December 15, 2015. 


develop work-arounds in real time, 
as needed. A spacewalk may take 
6 or more hours outside. Once the 
crew is back inside, a couple hours 
of work is required to get the airlock 
repressurized, get the crew members 
out of their suits, and (essentially) 
close up shop for the day. 

Vehicle dockings can be just as 
complex, especially for the ground 
team, although in most cases the 
ISS crew does not have as much 
of the workload as on an EVA day. 

In the weeks prior to the arrival of 
a visiting vehicle, the lead team 
assesses the ISS power requirements, 
reviews any station attitude control 
configuration changes or maneuvers 
needed for rendezvous, and looks 
at the trajectory of the incoming 
spacecraft to determine positioning 
constraints for any of the articulating 
appendages such as the robotic arm, 
solar arrays, or radiators. In most 
cases, the team needs to feather at 
least some solar arrays so that plumes 


from the thrusters of that vehicle do 
not hit the wrong part of the array, 
which could cause structural loading 
and/or contamination. Arrays that are 
feathered generally are not producing 
as much power as normal, so it might 
be necessary to turn some systems off 
to preserve margin on the batteries 
during the rendezvous, as discussed 
in Chapter 9. 

ISS systems are configured for the 
operation several hours ahead of 
the vehicle arrival (Figure 10). As 
much of the systems configuration 
as possible is done from the ground, 
but any system that the crew may use 
during approach will be set up by 
the crew. Depending on the vehicle, 
that may include video cameras, the 
robotic arm system, ship-to-ship 
communications and monitoring, or 
simply a still camera used by a crew 
member at a window facing the right 
direction. The crew will also prepare 
the hatchway(s) and pressure check 
hardware for use after docking. 


As with any mission, the work 
does not end just because the crew 
has made it back to Earth, as seen 
in Figure 11. Unlike getting the 
astronauts from Houston to the 
launch site where the crews take 
commercial flights to Moscow and 
then a Russian Space Agency plane 
to the launch site, getting the crew 
back to Houston expeditiously is 
a major operation in itself. It is 
important to return the crews as 
quickly as possible to perform 
postflight medical studies and begin 
the rehabilitation to Earth’s gravity. 
NASA uses a Gulfstream G3 aircraft 
to fly the astronauts from Kazakhstan 
back to Houston (Figure 12). With 
a range of about 4,200 km (2,600 
miles), the G3 cannot make the trip 
with a single crew due to the long 
duty day. Hence, it requires two flight 
crews of three personnel (two pilots 
and one flight engineer) to handle the 
long transit time of about 19 hours. 



Figure 11. The Soyuz is seen as it lands with 
Expedition 43 Commander Terry Virts of NASA, 
cosmonaut Anton Shkaplerov of the Russian 
Federal Space Agency (Roscosmos), and 
Italian astronaut Samantha Cristoforetti from 
the European Space Agency near the town of 
Zhezkazgan, Kazakhstan, on June 11, 2015. 
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Figure 12. The NASA Gulfstream G3 waits on the tarmac in Karagandy, Kazahkstan, in June 2016 
to return the Expedition 47 astronauts Timothy Kopra and Tim Peak to Houston for postflight medical 
studies and rehabilitation. 


About 8 days before the crew is 
expected to land, the first flight 
crew flies commercial to Europe, 
usually Scotland or Norway, and 
waits for the G3 to arrive. The G3 
departs Houston with the second 
crew 4 to 5 days prior to the landing. 
The two crews swap in Europe, 
and then the G3 continues to 
Kazakhstan to await the return of 
the crew. The crews swap again 
when the G3 arrives in Europe and 
the first crew returns on commercial 
airlines the next day. 

Postflight medical evaluations and 
debriefs with the various specialist 
teams take up several weeks of the 
returning crew’s schedules. The 
crew members are asked about 
their experience on board with key 
systems, procedures, payloads, and 
activities. Their feedback helps 
the team improve operations and 
overall support. Just as during flight 
preparation, this process can include 
international travel, although as 
much postflight activity as possible 


is planned to take place in the crew 
member’s home country. 

The increment lead flight director 
schedules a lessons-leamed JOP, 
at which the lead flight controllers 
discuss issues, gotchas, and process 
improvements, and watch items for 
upcoming increments. Major topics 


from this discussion roll into a report 
up to the ISS Program management, 
where actions may be assigned to 
track specific issues to resolution 
before they can impact a future 
increment team. 

Fun, welcome-back events take 
place, as well. Friends, family, and 
colleagues may come to Ellington 
Field in Houston to greet the returning 
US astronauts, usually within a day 
of landing. NASA hosts a welcome- 
home ceremony and presentation 
by the crew members of memorable 
slides and videos from their time on 
board for the personnel (and their 
families) who supported the mission. 

The increment lead flight director and 
any lead flight directors for major 
complex ops during the increment 
have a difficult task at the end of 
the mission: they have to pick the 
flight controllers who will “hang 
the plaque” in Mission Control. 

This is a time-honored tradition in 
Houston. A flight controller who 
distinguished himself or herself 
through work supporting the mission 
gets to climb a ladder and hang the 


Terrestrial Challenges Getting Home 

After more than 24 trips to return astronauts to Houston, the Aircraft 
Operations Division within the Flight Operations Directorate has proven 
to be successful in its mission to get the crews back quickly and safely. 
However, the flights are rarely routine. Weather can create challenges for 
pilots, such as delays in departure and en route. Since a relief crew is 
staged at a particular location, the G3 has to pass through or very near 
that town. Even the best planning can run afoul, as was the case when 
the Grimsvotn volcano in Iceland erupted in May 2011 while the G3 was 
in Kazakhstan awaiting the Soyuz landing. The team had to scramble 
to move the Europe crew to a location in England, which involved 
planning new routes at the last minute to complete the missions. NASA 
replaced the G3 with a G5 aircraft with longer range to eliminate some 
of these challenges. 
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Figure 13. On February 17, 2016, Operations Support Officer Chelsea Shepherd gets the honor 
of hanging the plaque for her work during Increment 45. Behind her is lead increment flight director 
Mike Lammers (center), flanked by astronauts Kjell Lindgren on his left and Kimiya Yui on his right. 

In the background, Expedition 46 astronauts Scott Kelly (commander, on the right within the screen 
image), Tim Peake (image center), and Tim Kopra (image left) support the ceremony with a live video 
link from the ISS. 



Figure 14. Expedition 19/20 plaque-hanging ceremony in Mission Control on November 5, 2009. 
Left to right: astronaut Michael Barratt, Lead Flight Director Courtenay McMillan, cosmonaut Gennady 
Padalka (behind McMillan), Telemetry Information Transfer and Attitude Navigation specialist Andrew 
Lee, Ground Controller Mitch Venable, astronaut Koichi Wakata, and astronaut Tim Kopra. Lee and 
Venable jointly hung the Soyuz TMA 14 plaque, as decided by McMillan. 


increment or mission plaque. The 
plaque is the patch design that was 
developed by the crew and placed 
by the flight director’s console 
during the increment. This event is 
typically scheduled when the crew 
can also attend; the on-board crew 
via videoconference is tied in to the 
event. Visitors to Mission Control 
will see dozens of these plaques 
hanging in the various flight control 
rooms. See Figures 13 and 14. 


Conclusion 

Each increment takes a great deal 
of teamwork between the flight 
controllers and the crew. More than 
a year before the astronauts fly, a 
dedicated team of flight controllers 
led by a flight director begins 
training the crew and preparing all 
the operations and procedures that 
will be needed during that time 
frame, and provides support as they 
complete training. Once the crew is 
launched, the team is responsible for 
all day-to-day operations. When the 
time frame is over, the team reviews 
what worked well and what did not, 
handing that information to the next 
team so that the operations continue 
to improve. The crew and flight 
controllers get very close, which is 
important because the crew depends 
heavily on the ground team. At the 
end of the increment, an exhausted 
team hands off to another team. A 
flight director once compared the 
process to climbing a mountain: It 
starts off gradual, then becomes very 
steep and requires a lot of hard work. 
Then you reach the summit and are 
glad you did it. By the time you get 
back to the bottom, you are ready to 
do it all over again. 
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Chapter 3 Systems: 

Structure and 
Mechanisms— 
The International 
Space Station’s 
Skeleton 




The Flight Director Class of 2009 (left to right: Scott Stover, Dina Contella, Ed Van Cise) in the Leonardo 
module as it was being upgraded from a short-duration Multi-Purpose Logistics Module to become the 
Permanent Multipurpose Module. Numerous elements of the module’s structure are visible, including the 
hatch, rack panels, bulkhead, ducting, and module feedthroughs—all aspects discussed in this chapter. 


As on Earth, revolutionary 
research in space often requires 
a physical laboratory Although 
the International Space Station 
(ISS) is a state-of-the-art research 
facility, it is also an outpost in low- 
Earth orbit that needs to sustain its 
crew to enable the research being 
performed. That means designing a 
space station that provides a shelter 
where the crew can live in a habitable 
environment that is protected from 
the dangerous conditions outside 
Earth’s atmosphere. That shelter 
needs supporting hardware to provide 
power, methods for distribution 
of that power, and computers 
with software to control all of the 
equipment. Facilities to support 
the living quarters and life support 
equipment inside the laboratory 
are required, in addition to actual 
research capabilities and facilities. 

These hardware and software systems 
are described in detail elsewhere in 
this book. This chapter describes 
the physical structures of the space 
station as well as the various methods 
used for assembling the spacecraft 
over the course of numerous 
assembly missions. 

Primary Structure 

The exterior of the ISS is made up of 
multiple modules with a very long 
truss structure running from side to 
side, as seen in Figure 1. 

The Integrated Truss System—or 
simply “the truss”—centered atop the 
US laboratory module, supports eight 
large solar arrays (see Chapter 9), 
mechanisms that allow those arrays to 
track the sun, two large radiator beams 
(see Chapter 11), and numerous 
Orbital Replacement Units (ORUs). 
ORU refers to any unit on the ISS 
that is designed to be serviced, 
repaired, or completely replaced. 


The ORUs on the truss include 
power distribution and conversion 
devices, Multiplexer/DeMultiplexers 
(MDMs) (see Chapter 5), pumps, 


sensors, and numerous research 
projects and experiments that 
need to be exposed directly to the 
unpressurized space environment. 



Figure 1. Assembly Complete configuration of the ISS as of July 2011. 
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Figure 2. Left image is the empty payload bay of orbiter Endeavour. The front of the payload bay is to the right where the Orbiter Docking System is installed 
and two flight deck windows are visible. The payload bay was 4.6 m (15 ft) in diameter and 18 m (60 ft) in length. This meant any cargo in the payload bay 
could be no larger than a 4.6 m (15 ft) diameter cylinder. The right image is the payload bay configuration for Space Transportation System (STS)-130/ISS-20A 
with Node 3 and Cupola as the primary cargo. Notice how the cylindrical shape of the module conforms to the shape of the payload bay. 


The truss also contains wiring and 
plumbing to connect all the ORUs. 

The Mobile Transporter and the 
Mobile Base System are mounted to 
a rail system on the front face of the 
truss. The Mobile Transporter can 
be moved to one of eight different 
worksites along the length of the 
truss. The space station’s robotic arm 
can be based on the Mobile Base 
System at any of these worksites. It is 
this mobility of the arm that enabled 
the assembly of the station’s truss and 
modules. These systems are covered 
in more detail in the Chapter 15. 

The cylindrical modules of the 
ISS—be they American, European, 
Japanese, or Russian—connect to each 
other to create a pressurized habitat 
where the crew lives and works in a 
shirtsleeve environment. The pressure 
inside the modules is maintained near 
Earth’s sea-level pressure, which is 
approximately 760 mm Hg (1 atm 
or 14.7 psi). The pressure outside 
the modules is essentially zero. That 
means the module structures must 
withstand an immense pressure 
force (760 mm Hg /14.7 psi) across 
every facet of its pressure-containing 
shell. The cylindrical shape of the 
modules is a strong shape that readily 


withstands this pressure. As seen 
in Figures 2 and 3, this shape also 
conforms to the shape of the Space 
Shuttle payload bay (for US Segment 
modules) and launch vehicle fairings 
(for Russian modules). 


Although the primary purpose of 
the pressurized modules is to keep 
the atmosphere in, and thus keep 
the crew alive, the modules must 
have feedthroughs to allow fluids 
(liquid and gas), power, and data to 



Figure 3. The US Laboratory module, Destiny, is supported by a frame that allows it to be rotated as it 
is being built. The reinforcing ribs that make up a waffle pattern that crisscrosses the primary pressure 
shell of the module can be seen. These pieces are normally under the orbital debris shielding and 
thermal insulation that makes each module appear smooth and round (as with Node 3 in Figure 2). 

This reinforcement is what gives each module enough strength to contain the atmospheric pressure 
that allows the crews to work in a shirtsleeve environment. 


SYSTEMS: STRUCTURE AND MECHANISMS-THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 


37 





























transfer between the inside and the 
outside (Figure 4). The feedthroughs 
are designed to ensure the holes 
in the module have at least two 
seals to vacuum. Additionally, the 
internal pieces of each feedthrough 
are specially sealed and tested to 
ensure no leaks occur from the cabin 
out to space through the connector. 
Every effort was made to minimize 
the number of items that must cross 
the pressure shell of the modules to 
minimize the risk of air leaks. 

Hatchways are also feedthroughs 
that provide a means to get into and 
out of each module (reference the 
“Hatches” section of this chapter). 
Windows provide a means for 
science experiments to study the 
Earth, for crew members to view 
their home planet, and for the 
operation of a number of educational 
programs. Windows are essentially 
large feedthroughs with optical 
panes installed instead of power 
or data connectors (reference the 
“Windows on the World” section of 
this chapter). 

Each of the holes in the primary 
structure of the modules for these 
feedthroughs was designed and 
reviewed for its ability to keep 
the atmosphere in and keep the 
crew safe. Each feedthrough is 
required to have at least two seals 
to the vacuum of space. Even with 
these precautions, the ISS crews 
are trained extensively on how to 
handle unexpected depressurizations 
that are either due to a failure in 
a seal of a module feedthrough or 
from an impact by orbital debris. 
Crew members are equipped with 
emergency response procedures and 
equipment that they can use to try 
to pinpoint the leak location and 
attempt to repair it. 



Figure 4. 

The interior of 
the Permanent 
Multipurpose 
Module pressure 
shell endcone 
with a number 
of power, data, 
and gas 
feedthroughs. 
Each electrical 
feedthrough in 
this photo is 
approximately 
4 cm (1.5 in.) 
in diameter. 


Pressurized Module 
Assembly 

Although the Russian modules of 
the ISS are all connected using an 
automated “probe-and-cone” docking 


system (Figure 5), this system does 
not allow for large hatchways that 
can accommodate transferring large 
objects, including various payload 
racks (reference the “Racks” section 
of this chapter), between modules. 



Figure 5. The probe docking mechanism of an incoming Progress cargo vehicle. This funnel-shaped 
probe interfaces with a receiving cone on the docking mechanisms of the Russian segment of the 
space station. The hatchway that the crew will translate through after docking, which is the space 
inside the two orange rubber o-rings, is 80 cm (31.5 in.) in diameter. 
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Figure 6. Top image: ISS as it appeared to the crew of STS-92/ISS-3A (2000) as they approached 
the space station. Middle image: The first assembly of ISS components using the CBM. Astronaut 
Peter J. K. (Jeff) Wisoff monitors as the crew of the orbiter uses the robotic arm to bring the Z1 truss 
(CBM at the top of the image) toward being ready to be latched by the active CBM of Node 1 (CBM at 
the bottom of the image). Bottom image: ISS as it appeared to the crew members as they departed the 
space station. Note that not only was the Z1 truss installed, but also the Pressurized Mating Adapter 3 
on to Node 1, opposite the Z1 truss (bottom of Node 1 in this photo). 


The hatchways of US Segment 
modules are larger than the Russian 
or Space Shuttle hatchways to 
accommodate the transfer of larger 
hardware. This larger interface 
required a different attachment 
mechanism that would hold the 
modules together in a way that could 
withstand larger forces. These forces 
are greater than those experienced 
by the Russian or shuttle docking 
interfaces due to having a larger 
surface area exposed to vacuum on 
one side and the sea-level pressures 
of a shirtsleeve environment on the 
other side. 

As shown in Figures 6 and 7, the 
Common Berthing Mechanism 
(CBM) is a complex collection of 
latches, bolts, Ready to Latch (RTL) 
indicators (reference the “Finding 
Ready to Latch” section of this 
chapter), and computers to control 
this equipment. This system can be 
operated by either the ground or 
the crew; extravehicular activities 
(EVAs) (i.e., spacewalks) are not 
required to use this mechanism, 
unlike some of the truss attachment 
systems. Once a new module is 
close enough to the ISS (RTL), four 
latches on the ISS side (usually a 
Node module) are used to reach out 
and “grab” the incoming module 
and pull it closer. Alignment guides 
ensure the bolts and nuts of the 
mechanism are in line with each 
other. Once the latches have pulled 
the two halves together, bolts on 
the active CBM are extended into 
nuts on the passive CBM. Each 
of the 16 bolts has a preload of 
approximately 90 kN (20,230 lbs) of 
force on it after the bolting sequence 
is complete. That is the equivalent 
of having the weight of just over six 
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Figure 7. Hardware component breakdown of 
the active (top) and passive (bottom) halves of 
the CBM. An RTL indicator is situated next to four 
of the alignment guides on the active CBM (not 
shown in the figure). 


mid-size automobiles stacked on 
each bolt/nut location. This keeps the 
three seals between the two halves 
securely compressed even with the 
high pressure difference between 
the ISS cabin and the vacuum of 
space. Three seal beads on the CBM 
interface provide fault tolerance. One 
seal bead can be scratched, leaking, 
or damaged and the CBM will still 
have two good barriers between the 
atmosphere and the vacuum. 



Figure 8. An example of a vestibule. This is the vestibule between Node 1 and Node 3 on 
STS-130/ISS-20A (2010) before all the power, data, and fluid jumpers were connected. Power and 
data cables for the active CBM are still installed (seen floating) but no jumpers are connected 
yet to the large or small feedthroughs on Node 3 (the module with the closed hatch). 



Figure 9. The vestibule between Node 1 and Node 3 after it has been fully outfitted and a white cloth 
closeout barrier has been installed to keep objects from getting trapped or lost inside the vestibule. 
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A vestibule is created between the 
two hatches when the two modules are 
connected. This is just like a vestibule 
between two train cars. In this 
vestibule area, the astronauts connect 
gas (e.g., oxygen, nitrogen, air), water, 
data, and electrical lines between the 
two modules. All of these utilities 
are connected inside the pressurized 
area of the vestibule but outside 
of the hatchway itself. This means 
the utility lines can be connected 
without an EVA, but the lines will 
not run across the open hatchways 
of the modules. For an example, see 
Figures 8 and 9. This configuration 
enables the crew to close the hatches 
quickly to isolate a module in an 
emergency, should it be required. 

The CBM not only connects the 
permanent US Segment modules 
during ISS assembly, it is also used to 
connect US cargo vehicles (e.g., H-II 
Transfer Vehicle [HTV], Dragon, 
and Cygnus) when they arrive. These 
cargo vehicles use the CBM interface 
because it provides capability for 
transfer of both small cargo bags 
and large hardware such as racks 
between the cargo vehicle and the 
ISS. Crewed vehicles use smaller 
docking systems because large 
hardware does not need to transfer 
between the crewed vehicles and the 
ISS. Docking mechanisms can also 
release the docked spacecraft faster 
than vehicles connected by CBM. 

Each CBM location can be operated 
multiple times, if needed. This 
capability enables cargo vehicles 
to be attached and detached from 
CBM locations dedicated to cargo 
operations. That CBM capability also 
means that permanent ISS modules 
can be detached and relocated to 
alternate CBM locations, if needed. 


The Manual Berthing Mechanism 

The early ISS assembly sequence had the Pressurized Mating Adapter 
(PMA)2 docking adapter on the front of Node 1. The Space Shuttle brought 
the US Laboratory to the ISS on STS-98/ISS-5A (2000). The orbiter docked 
to PMA3, located on the bottom (nadir) side of Node 1. The astronauts 
needed to remove PMA2 from the front of Node 1, put PMA2 somewhere, 
install the US Laboratory on the front of Node 1, and then put PMA2 on 
the front of the US Laboratory. To make this happen, an additional CBM 
location was required to temporarily store PMA2 while the US Laboratory 
was being installed. This need was realized early in the ISS design 
development; therefore, a manually operated CBM that used only latches 
(i.e., the Manual Berthing Mechanism (MBM]) was added to the front side 
of the Z1 truss (Figure 10). This enabled the astronauts to move PMA2 to 
this Z1 location and house it there temporarily while the US Laboratory was 
being installed. The spacewalkers then released PMA2 from the MBM and 
moved it robotically to the front of the US Laboratory. The MBM, while still 
in place on the front of the Z1 truss, fulfilled its job during that mission and 
has not been used since. 



Figure 10. Photo of the ISS as STS-92/ISS-3A (2000) departed, showing the Z1 truss on 
top of Node 1 with the large ring of the MBM on the front of the truss. The round and square 
targets in the middle of the MBM are Space Vision System targets. The Space Vision System 
is discussed in more detail later in this chapter. 


SYSTEMS: STRUCTURE AND MECHANISMS-THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 


41 






Truss Assembly 

The ISS is not solely a collection of 
connected cylindrical modules in 
which the crew can live and work. 

In addition to these modules, the ISS 
needs the additional truss structure 
to support its eight solar arrays, its 
external radiators, the equipment to 
run all of those external systems, and 
a place to mount the large number of 
science experiments that are running 
in the space vacuum. 

This truss system, often called the 
“backbone of the ISS,” is attached 
to the US Laboratory module by 
10 struts that connect to the center 
SO truss segment. The truss was, 
of course, not flown up as a single 
unit. Rather, smaller truss segments 
were flown up, and the truss was 
assembled on orbit. As can be seen 
in the image of the ISS in Figure 1, 
one side of the truss system appears 
to be a mirror image of the other 
side—and that is indeed the case. 

Not only are the truss segments 
mirror images, the system hardware 
installed on the truss is mirrored in 
many places. For example, for the 
Port Solar Alpha Rotary Joint, which 
connects the P3 and P4 trusses (see 
also Figure 3 in the Introduction and 
Figure 8 in Chapter 9), to turn in 
the same direction as the Starboard 
rotary joint, ground controllers must 
use commands with values that are 
the negative of what is sent to the 
Starboard joint. If this inverse-value 
commanding were not performed, 
the two joints would turn in opposite 
directions because the joints are on 
opposite sides of the truss but use the 
same rotary joint control software. 

Assembly of some of the truss 
segments was completed using 


only robotic arms and computer 
commands. The computer-controlled 
attachment mechanism, known as 
the Segment-to-Segment Attachment 
System, connects SO to SI, SI to S3, 
SO to PI, and PI to P3. During EVAs, 
astronauts used handheld power tools 
to drive the interfacing bolts of the 
Rocketdyne Truss Attachment System 
for other truss segment connections, 
namely the Z1 to P6 (during the 
early ISS assembly time frame), S4 
to S5, S5 to S6, P4 to P5, and P5 to 
P6 connections (all the connections 
outboard of the P3/S3 trusses). 

The mechanical concept was 
the same whether an automated 
mechanism or a manual mechanism 
was used—four large bolts on one 
side of the truss segment were driven 
securely into the receiving nuts of 
the adjoining truss segment. All of 
the major truss pieces, all of the 
large components attached to the 
trusses (some of which rotate), and 
all of the hardware within the truss 
segments are connected through 
only four bolts/nuts at each truss 
element interface. This entire truss, 
which is 109 m (375.5 ft) in length, 
is connected to the US Laboratory 
module by 10 attachment struts. 


Structural Health 

A primary engineering concern is 
how loading events can cause the 
hardware of the ISS to fatigue over 
time, which may impact how long 
the engineering teams believe the 
spacecraft structure can remain 
in orbit without failing. With the 
significant mass of the ISS and the 
loads it experiences being handled 
across the relatively few connecting 
points of the truss, engineering 


teams need to ensure their ground 
models of the ISS structural stress 
and loading match what is actually 
being experienced by the vehicle. A 
few of the various loads that the truss 
must withstand include vibrations 
from rotating equipment, crews 
pushing off interior walls, contact 
with a vehicle that is docking, and 
thermal expansion and contraction. 
The ground model comparison is 
especially important in the assessment 
on whether the lifetime of the ISS 
hardware can be certified beyond the 
original design life expectancy. A 
number of instrumentation systems 
have been installed both inside 
the ISS pressurized modules and 
externally on the ISS truss. These 
systems—the Internal Wireless 
Instrumentation System, the External 
Wireless Instrumentation System, 
and the Structural Dynamics 
Measurement System, along with 
others—collect engineering data 
on the stress, strain, dynamics, and 
accelerations imparted on the ISS 
structure during various events 
and stages of ISS assembly and 
operations. These data are not only 
useful for improving the accuracy of 
ground engineering models to help 
perform analysis for future events 
such as upcoming vehicle dockings or 
space station maneuvers, the data are 
also useful for reconstructing what 
impact past events may have had on 
the ISS structure. 

For example, in 2009, a 
misconfiguration of some thruster 
parameters during a reboost caused 
the Service Module main engines 
to pulse at a frequency that was a 
harmonic with the ISS truss. This 
essentially meant that the ISS truss, 
along with the attached ISS modules, 
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Why is there no S2 or P2 truss? 

The heritage of the ISS design shows up in many different, oftentimes small, 
ways. One of the larger but perhaps not as obvious instances is with the 
naming of the truss segments. Although the ISS does not have an S2 truss 
or a P2 truss, these truss segments were actually in the Space Station 
Freedom design (the precursor design to the ISS). These truss segments 
were going to house the thrusters needed to control the attitude and altitude 
of Freedom. When the Russian Space Agency became an ISS Partner and 
its modules took the role of housing the thrusters, the S2 and P2 truss 
elements were no longer needed and were removed from the design. The 
overall design was far enough along in development that it was decided to 
not rename the other truss segments. 


were flexing and bending at the same 
time each thruster firing occurred. 
Each thruster firing then further 
excited or increased the bending and 
loads being experienced by the ISS 
structure. After the reboost, engineers 
used structural measurement data 
to assess any damage to the ISS 
structure (none occurred) and the 
potential impact to the overall 
lifetime of the structure (engineers 
noted a slight, nearly negligible 
reduction in ISS structural life of 
some components). 

A household example might be akin 
to having an off-balance load in a 
clothes washer. In this situation, 
the washer will “jump around” due 
to the off-balanced load. This will 
cause some wear and fatigue on the 
spinning parts and structure of the 
washer. A single off-balance event 
will cause minimal impact or damage 
to the washer. However, if the washer 
ran with numerous off-balance loads 
for long periods of time, the hardware 
would degrade and the washer would 
likely break or fail earlier than 
designed or expected. 


Truss Attachment Sites 

Another component of the two truss 
attachment mechanisms is a capture 
latch. This component was used in a 
fashion similar to the latches on the 
CBM. When a new piece of truss was 
close enough (i.e., RTL) to the ISS 
truss, the latch would be used to grab 
a capture bar on the new truss and 
draw it closer to the ISS truss. This 
capture latch can best be pictured as 
a large claw that would close around 
that capture bar. 

Due to its robust and adaptable 
function, this capture latch/claw 
design is used in many other places 
externally on the ISS. As mentioned 
previously, a number of science 
experiments are mounted on the ISS 
truss. Also, a large number of spare 
parts are mounted on the truss for 
use by spacewalkers or the Special 
Purpose Dexterous Manipulator robot 
to fix broken external hardware (see 
Chapter 15). Spare parts and many 
research experiments are attached to 
large carrier platforms, either External 
Stowage Platforms or Expedite the 
PRocessing of Experiment to the 


Space Station (ExPRESS) Logistics 
Carriers. These carriers are secured to 
the truss using a Payload Attachment 
System (PAS) or an Unpressurized 
Cargo Common Attachment System 
(UCCAS). These systems use 
mechanisms that implement the 
common capture latch design as well 
as Umbilical Mating Assemblies 
(UMAs). The UMAs provide power 
and data from the ISS to the carrier. 
Two UCCAS sites are located on 
the P3 truss, and four PAS sites are 
located on the S3 truss. Reference 
Figure 4 in the Introduction to identify 
the hardware carriers attached to 
the S3 and P3 trusses on the ISS. 

In that figure, the Alpha Magnetic 
Spectrometer telescope is mounted to 
one of the S3 PAS sites. 

As has been pointed out, the 
attachment mechanisms of the ISS 
are required to hold a large amount 
of mass and withstand significant 
loading, bending, and vibration. The 
mechanisms themselves must be 
very robust and capable to ensure the 
various designs will perform these 
functions. Care had to be taken during 
assembly operations using these 
mechanisms to make certain that the 
mechanisms, while actuating latches 
or bolts, were operated in a specific 
sequence. This sequence was analyzed 
prior to the operation to ensure the 
use, or a failure of a component 
during that use, would not cause 
damage to any of the ISS hardware 
involved (including the robotic arm). 
This is just one more example where 
the operations and engineering teams 
worked closely together to ensure the 
method of operations planned by the 
operations teams would stay within 
the limits analyzed by the engineering 
teams (often integrated by the End-to- 
End Berthing Integration Team). 
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Finding Ready to Latch 

Assembling truss segments and 
pressurized modules all start with 
the same requirement—the new 
component needs to be close enough 
to its intended mating location to be 
RTL. The actual RTL indicators look 
different depending on the mechanism 
being used, but they perform the 
same function. The RTLs move when 
touched by the incoming module/ 
truss. This movement signals to the 
robotics operators (crew or ground) 
that the new piece is indeed close 
enough, and that use of the mechanism 
can start. An example of this can be 
seen in Figure 6 (middle). This image 
from STS-92/ISS-3A (2000) shows 
the passive CBM of the Z1 truss 
being robotically brought close to the 
active CBM of Node 1 Zenith prior to 
achieving an RTL condition. 

The robotics operators need to 
know how well the new element is 
positioned with respect to the ISS 
mechanism prior to the element being 
at the point of touching the RTLs. 
Although the trusses and modules 
are large, very little tolerance for 
misalignment is allowed between 
two pieces. The robotics operators 
must precisely align the incoming 
element so that it can touch those 
RTL indicators. 

Realizing this critical need for 
assembly of the ISS in orbit, engineers 
designed a computer-generated Space 
Vision System (SVS). The SVS was 
an optical system that used computer 
evaluation of camera views to 
precisely determine the misalignment 
between the ISS and the new 
component. Myriad SVS targets— 
decals with white and black dots 
(visible in Figure 10)—were installed 
on modules and truss segments. Prior 
to launch, the placement of these 


FLIGHT RULE B12-111, PARAGRAPH A: During mating operations, when between 
14 inches and 6 inches X-distance separation, the roll and lateral misalignments 
shall ensure 9R+20L < 73 (depicted in diagram below). If this constraint is not maintained, 
the operator must separate the PCBM and ACBM rings. The operator should back out in 
the X direction until 14 inches of separation is met, or the corridor is reattained. 


Roll vs. Translation to Ensure Proper Guide Meshing 



Figure 11 . A portion of Flight Rule B12-111 “CBM Capture (RMS Translation) Corridor Constraints” 
that explains to the flight controllers how wobble (i.e., a combination of roll and lateral offsets) must be 
controlled to ensure the CBM halves are properly aligned at the RTL position. Meshing occurs when the 
CBM halves are separated between 15 cm and 35.5 cm (6 in. and 14 in.). The lateral offset can range 
between 0 cm and 10 cm (0 in. and 4 in.). 


targets was measured precisely with 
respect to various reference points on 
the truss/module. This measurement 
information was loaded into the vision 
system computers of the robotic 
arm. These computers, knowing 
the precise location of the targets, 
could then use camera views to 
identify specific targets, precisely 
compute misalignment information, 
and provide that information to 
the operators. 

Unfortunately, an SVS solution could 
only be obtained in orbital daylight 
(which is roughly 45 minutes or less of 
every orbit). The SVS was susceptible 
to losing an acquired solution due to 
sun reflection off the surfaces of the 
trusses, modules, or orbiter, or if the 
targets were obscured by shadows. 
NASA successfully used the SVS 
during early stages of ISS assembly; 


however, the agency decided soon 
after the first assembly mission 
(STS-88/ISS-2A [1998]) that a new 
“boresighf ’ or centerline camera 
misalignment system was needed. 

Centerline camera systems were not 
a new concept. The Space Shuttle 
always used a centerline camera on 
its docking mechanism window to 
help crews make final alignments for 
docking to the Mir space station and 
to the ISS. Space Station Freedom, 
a design precursor to the ISS, also 
included use of a centerline camera 
mounted on the ISS hatches to view 
incoming modules through the hatch 
windows to determine misalignments. 

Although the SVS was ultimately 
selected for use with the ISS in its 
design phase, the centerline camera 
was not completely removed from all 
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Figure 12. The view of an incoming module that an astronaut sees on his or her Robotic Workstation 
monitor from the CBCS camera. Green reference and targeting lines are computer generated by the 
robotics system and drawn on top of the video image. These lines assist the crew in aligning the new 
module. The four quadrants of red lights are reflections of light-emitting diodes around the CBCS 
camera that are used to illuminate the CBCS target on the incoming element. The camera is looking at 
the hatch window of the incoming module (Node 2 in this case) and the reflective CBCS target mounted 
around the hatch window (red chevrons). 


Freedom design drawings. As many 
Freedom components were carried 
into the ISS design with minimal 
change, the US Segment ISS hatch 
was the same hatch design as the one 
originally created for Space Station 
Freedom. The mounting points for 
the centerline camera system were 
not removed from the hatch design in 
the conversion to the ISS. This meant 
that when a centerline camera was 
developed after the Node 1 mission, 
the hatches already on orbit on Node 1 
as well as the hatches on the modules 
being assembled already had locations 
in which to mount a centerline camera 
to the hatch. Thus, the Centerline 
Berthing Camera System (CBCS)—a 
cousin to the initial design concept for 
Space Station Freedom—was rapidly 


designed, certified, and implemented 
to assist in berthing pressurized 
modules to the ISS. 

The CBM is relatively intolerant 
to misalignments. When the two 
halves are 35 cm (14 in.) apart, 
only 5 degrees of wobble and 
minimal roll and lateral offsets are 
allowed (Figure 11). When it comes 
to misalignments, operators are 
concerned about both translational and 
rotational errors. Lateral misalignment 
is the offset in the up-and-down and 
side-to-side directions relative to the 
center of the CBM. Rotational errors 
are measured in roll (twisting about 
the center of the CBM) and wobble 
(a combination of pitch-and-yaw 
errors). By using the CBCS camera, 
robotics operators who are looking 


at a target on the hatch of the new 
module coupled with a data overlay 
on the robotics monitor (Figure 12) 
can detect any misalignments and 
adjust the position of the module until 
all misalignments are within limits. 
The operators can also determine the 
proximity of the module (the target 
gets bigger as it gets closer to the 
camera) and whether it is about to 
push one of the RTL indicators. CBCS 
was first used on the STS-98/ISS-5A 
mission in 2000; the camera was 
mounted on Node 1 and used to 
connect the US Laboratory to Node 1. 
CBCS has been used successfully on 
every pressurized module installation 
since that time. 

Unfortunately, a CBCS type of 
system could not be designed swiftly 
enough to assist in the connection 
of the ISS truss segments. Instead, 
those operations relied on the less- 
user-friendly SVS along with the 
on-the-scene direction from nearby 
spacewalking astronauts. With these 
astronauts in close proximity to the 
massive truss segments helping guide 
the installation, special care and 
choreography was required to ensure 
the crew was always safely away 
from the truss connection points and 
moving hardware. 

An External Berthing Camera 
System (EBCS) was, however, 
installed on the S3 and P3 trusses. 
This system is used to assist in 
installing the cargo carriers to the 
PAS and UCCAS sites. The targets 
for this system are installed on the 
S3 and P3 trusses, and the cameras 
are installed on the cargo carriers. 

This is the opposite of the CBCS 
where the camera is attached to the 
ISS, and the target is on the new/ 
upcoming hardware. The cameras 
on the carriers receive their power 
from the space station’s robotic arm 
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Figure 13. A photo of a monitor of the ISS robotics workstation during installation of an Expedite 
the Processing of Experiments to the Space Station (i.e., EXPRESS) Logistics Carrier during the 
STS-129/ISS-ULF3 mission in 2009. Similar to Figure 12, the monitor shows both a view from the 
centerline camera as well as a green, digitally drawn graphical overlay. The robotics operators 
(crew or ground) use the overlay lines to gauge the amount of misalignment between the target 
(center of the picture) and the camera (ring of light-emitting diodes). 


instead of from the truss (Figure 13). 
This novel approach of putting the 
cameras on the carrier and the passive 
target on the truss enabled the EBCS 
to be implemented on a schedule that 
would not slow down the fast pace 
of readying the truss segments for 
launch and installation. 

Due to the success of the CBCS and 
EBCS camera systems, the Japanese 
HTV cargo vehicle uses a similar 
HTV Berthing Camera System to 
assist with inserting its Exposed Pallet 
(EP) back into HTV after it has been 
removed from a temporary stowage 
location on the Japanese Experiment 
Module (JEM) Exposed Facility. 

Secondary Structure 

With the foundation and walls (the 
primary structure) of the orbiting 
laboratory built, the ISS needed to 
be outfitted to actually be able to 
accomplish its mission. “Secondary 
structure” provides the means 
for outfitting the laboratory. The 
secondary structure is the equivalent 
of elements such as wallboard, 
light fixtures, flooring, and major 
appliances in a home. 

Docking Systems 

One of the first necessary pieces of 
secondary structure is a way for the 
occupants of the ISS to get into the 
space station. This means having a 
method to dock a crewed vehicle. 

The ISS is outfitted with six docking 
ports. Four docking ports on the 
Russian Segment use the Russian 
probe-and-cone docking system. 
Visiting Progress cargo ships, crewed 
Soyuz ships, and the European 
Automated Transfer Vehicle dock to 


these ports. On the US Segment, the 
Space Shuttle used a Russian docking 
system called the Androgynous 
Peripheral Attachment System 
(APAS). The Space Shuttle used 
this system to dock with the Russian 
Mir space station as well as to the 
ISS. Whereas the Space Shuttle had 
the active half of the APAS, the ISS 
had two docking ports with passive 
APAS halves. These halves were 
located on PMA2 and PMA3. After 
the retirement of the Space Shuttle 
fleet, the PMAs are being updated to 
add International Docking Adapter 
extensions to the passive APAS 
halves. This will allow future crewed 
vehicles to use a newer docking 
mechanism, built off internationally 
agreed-to standards, to dock to PMA2 
and PM A3. 


Shields Up! 

One significant concern—in fact, one 
of the ISS Top Program Risks—is 
the orbital debris environment in 
low-Earth orbit. The US Air Force 
tracks large pieces of space debris 
(i.e., debris larger than 10 cm [4 in.] 
in diameter) and the ISS can perform 
debris-avoidance maneuvers (see 
Chapter 8) to change its orbit and 
thereby avoid those objects. The 
impact of a 10 cm (4 in.) object on 
the ISS would have an explosive 
force equivalent of 7 kg (15 lbs) of 
trinitrotoluene (i.e., TNT). Being able 
to get out of the way of these large 
debris pieces is an important part of 
the overall strategy of ensuring the 
ISS is not penetrated by orbital debris. 
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Really androgynous? 

Most mechanisms that involve joining two items together have a side that 
is active and a side that is passive. The active side has all the hardware that 
moves and all the computers needed to command and control that moving 
hardware. That moveable hardware (e.g., latches or bolts) interfaces with 
non-moving (passive) hardware on the other side of the interface. Examples of 
passive hardware include nuts, non-moving hooks, latch capture plates, etc. 

In some mechanisms, both halves have the same moveable hardware. In these 
cases, one side of the mechanism is designated as active, and its hardware 
is made to move while the hardware on the other side remains stationary and 
passive. These roles could be reversed on a subsequent use. This setup for a 
mechanism is termed an “androgynous” configuration. See Figure 14. 

If the APAS were truly androgynous, the system on the ISS PMA or on the 
orbiter could serve as the active half of the docking system. Although both 
halves indeed had the same hooks and latches, the active hardware (i.e., 
motors, controlling computers, pyrotechnic bolts, etc.) was removed from 
the ISS halves prior to launching the PMAs. That means the orbiter side was 
always active. The ISS half of the docking mechanism hooks could not be 
driven, and the explosive bolt pyrotechnics for releasing those hooks were 
not installed. Should the hooks on the orbiter side have failed to release the 
ISS, the orbiter side could have pyrotechnically separated its hooks (and, 
thus, left that docking port permanently unusable). And, if for some reason the 
pyrotechnics did not work either, a spacewalking astronaut could manually 
separate the two docking system halves by removing 96 bolts around the 
perimeter of the docking mechanism. Thankfully, that task was never required. 



Figure 14. The two androgynous docking system alignment guides are about to overlap, as 
seen out the orbiter’s aft flight deck window just prior to docking on STS-100/ISS-6A (2001). 


The orbital debris strategy must, 
however, also deal with thousands 
of smaller objects that cannot be 
tracked and thus cannot be directly 
avoided. The ISS modules—US 
Segment, Russian Segment, and all 
temporary crew and cargo vehicles— 
are designed to protect against 
the impact of very small (1 cm 
[0.4 in.] diameter or smaller) debris. 
This protection comes via another 
secondary structure component, 
debris shielding, which is described 
in more detail in this section. 

Debris too small to be tracked but 
still too big to be assuredly stopped 
by debris shielding could penetrate 
the ISS shields and pressure shell. 

The ISS crews are trained extensively 
on how to respond to rapid cabin 
depressurizations due to midsize 
orbital debris penetrations, should one 
ever occur. In these scenarios, crew 
members first remove themselves 
from the immediate area of impact, 
ensure their rescue vehicles are not 
leaking, and work to isolate the 
module with the leak by closing 
various module hatches. 

In the event a piece of debris 
penetrates the pressure shell of the 
ISS, on-board tools and repair kits 
help the crew pinpoint the leak/ 
penetration point (which could be 
a very small hole, numerous small 
holes, or a larger gash) and attempt to 
repair the damage. Current on-board 
repair kits should allow the crew to 
repair holes up to 1.25 cm (0.5 in.) in 
diameter, assuming enough reserve 
time is available to find and repair the 
leak. Reserve time is the calculated 
time remaining before the cabin 
pressure drops below 490 mm Hg 
(9.5 psi). Once the pressure drops 
that low, crew members must isolate 
and seal off the leaking compartment 
(if the location is known) or isolate 
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themselves in their return vehicle 
and prepare for possible departure 
from the ISS. To provide some time 
margin, the crew is trained to seal 
off a leaking compartment with 10 
minutes of reserve time remaining. 

Research efforts to develop the best 
possible methods for mitigating the 
risks and damage from debris impacts 
have been ongoing for as long as 
humans have been flying objects 
in space. This research has been 
conducted within NASA, academia, 
industry, and internationally. The 
potential outcome from debris 
impacts puts risk on uncrewed 
satellites as well as human-tended 
spacecraft. For the ISS, the placement 
and type of debris shielding varies 
depending on the location of the area 
being shielded and the duration of 
time that module is on orbit. This 
is all factored into an engineering 
calculation called the Probability 
of No Penetration. For more details 
on the ISS Program response to the 
Micrometeoroid and Orbital Debris 
(MMOD) risk, reference the 2012 
Aerospace Safety Advisory Panel 
Report at http://oiirhq.nasa.gov/asap/ 
reports.html. 

Most US Segment debris shielding 
employs hard aluminum panels 
mounted atop the primary pressure 
shell of the module. The thickness 
and placement of debris shields 
are based on the Probability of 
No Penetration. Shields that will 
face forward—i.e., the direction 
in which the ISS is flying for most 
operations—are generally thicker 
since these areas have the higher 
probability of being hit by debris. 

The panels of the US Segment 
debris shields are separated from the 
pressure shell to create a gap between 
the panel and the shell. This gap 
serves two purposes. First, numerous 



Once all the equipment that needs to be attached 
to the pressure shell or run under the insulation 
blankets is installed, the blankets themselves are 
installed. These blankets are a thick composition 
made of materials such as NexteP and Kevlar®. 
These materials not only insulate the pressure 
shell, they serve as another debris barrier where 
MMOD energy is dissipated and debris is broken 
into smaller fragments. This photo shows some of 
the MU blankets on the Joint Airlock. 


Once the MU blankets are installed, the MMOD 
shields can be installed. Some equipment, such 
as these EVA handrails on Node 2, are also 
installed onto the outside of the shields. The 
shields are designed to be easily removable 
by spacewalking astronauts to access the 
equipment under the shields and MU blankets. 


Node 2 module pressure shell. The final barrier 
between debris and the internal pressurized 
cabin. Note the waffle pattern on the aluminum 
cylinder that helps increase the strength of the 
shell, and the large longitudinal rings that create 
barrel sections of the cylinder. 


Generally, a number of wire harnesses for 
power or data, or fluid lines run outside the 
pressure shell but underneath the MMOD shields 
and insulation. Shown are some of the wires 
running underneath MMOD shields of the 
Node 2 module. 


Figure 15. The debris shielding of the Node 2 module starting at the top left with the pressure shell, 
followed (top right) with various wire harness, followed (bottom left) by insulation materials, and finally 
(bottom right) the outer debris shield panel. 


utility lines and other hardware that 
do not need to be in the pressurized 
environment are underneath these 
panels. This protects them from 
exposure to the atomic oxygen of 
the low-Earth orbit environment and 
also protects them to some degree 
from orbital debris. Second, a layer 
of tough, insulating material called 
Multilayer Insulation (MLI) is placed 
between the debris panels and the 


pressure shell. This provides another 
debris barrier and thermal insulation 
for the pressure shell. Figure 15 
shows the build-up of this type of 
debris shielding. 

This shielding setup is a Stuffed 
Whipple Shield design. When a 
piece of debris strikes the debris 
panel, some debris is stopped at that 
point since it does not have enough 
energy to penetrate the shielding. 
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Some debris with higher energy will 
penetrate the shielding. The debris 
will lose energy and fracture into 
multiple smaller pieces. These pieces 
will travel through the insulation 
material, which will cause the debris 
fragments to continue to lose energy 
and spread out from the point of 
penetration. Debris that started 
smaller than 1 cm will either not 
make it to the primary pressure shell, 
or will strike the pressure shell but 
not penetrate. 

Other areas of the ISS where the 
likelihood of debris strikes and 
penetration are lower, or areas that 
are not habitable by the crew, may 
be protected only by thick insulating 
blankets. This is true for many areas 
of the Russian Segment, especially 
the shorter-duration Soyuz and 
Progress vehicles. For this shielding, 
the blanket properties and thickness 
are such that the debris will be 
stopped prior to penetrating the 
pressure shell. 


Figure 16. The smooth internal side of a US Common Hatch. This side faces into each module. Note 
the handle in the center right that the crew turns to latch or unlatch the hatch, a deployable handle at 
the bottom center to engage or release the hatch from its stowed position, a valve in the bottom right 
corner of the hatch used to equalize the pressure between the two sides of the hatch prior to opening 
the hatch, and a window in the center of the hatch. 


Hatches 

As mentioned previously, one of the 
larger feedthroughs in any module is 
the hatchway. These hatchways enable 
crew and cargo to pass between 
modules. Each module has a hatch to 
close off each hatchway vestibule for 
each module to remain pressurized 
before it is attached to the ISS, and to 
allow for the isolation of the modules 
in the event of a depressurization or 
contaminated atmosphere. The US 
Common Hatches are 1.2 m (50 in.) 
square in size (Figures 16 and 17). 

The hatch system is designed such 
that when the hatch is closed, the 
force of the internal module air 
pressure pushes the hatch against the 
bulkhead seals of the module and 


provides the sealing force. Latches 
are included on the hatches, but these 
latches are only needed to ensure the 
hatch is aligned with the bulkhead 
and pulled close enough to the 
module such that the air pressure can 
provide the sealing force. The latch 
mechanisms also have a component 
called a “kicker” that pushes against 
the module bulkhead when the hatch 
is unlatched to help push the hatch off 
the bulkhead. 

The round hatches of the Russian 
Segment modules are 80 cm (31.5 in.) 
in diameter. This includes the hatches 
between module vestibules as well as 


hatches between modules and docked 
vehicles (i.e., Progress, Soyuz, or 
Automated Transfer Vehicle). The 
hatches on PMAs 1, 2, and 3 are also 
80 cm (31.5 in.) in diameter, based on 
the Russian hatch design. 

Additional hatches on the ISS include 
the inner and outer hatches on the 
Japanese Airlock and the outer egress 
hatch of the Joint Airlock. The EV 
(for extravehicular) hatch on the Joint 
Airlock is the same Shuttle B-type 
hatch that was found on the airlock 
of the orbiter. This is due to the fact 
that the Crewlock portion of the Joint 
Airlock is actually an exact duplicate 



SYSTEMS: STRUCTURE AND MECHANISMS-THE INTERNATIONAL SPACE STATION’S SKELETON CHAPTER 3 


49 













































Windows on the World 



Figure 17. The external side of the Permanent Multipurpose Module hatch prior to launch. The actual 
hatch mechanisms and linkages are all on this side of the hatch—the side that faces space vacuum. 
Note that both the internal side and the external side of the hatch have crank handles; the hatches can 
be opened or closed from either side of the hatch. 


of the orbiter airlock. The Crewlock 
is attached to the larger Equipment 
Lock of the airlock. A US Common 
Hatch at the Equipment Lock/ 


Crewlock interface allows only the 
Crewlock to be depressurized when 
crews go on EVAs (see Chapter 17). 


The ISS has numerous windows. 
These windows are large 
feedthroughs that run the risk of 
leaking; the large, fragile panes of 
glass could easily be damaged by 
orbital debris. It stands to reason 
that the occupants of the Earth¬ 
orbiting outpost would want to be 
able to see the planet. Although the 
windows enable crew members to 
look down at their home, sightseeing 
is far from the primary purpose 
for those windows. In fact, the 
windows on the ISS are positioned 
primarily for scientific research and 
educational purposes as well as for 
enabling the crew to have situational 
awareness of the space immediately 
around the space station during 
EVAs and robotic operations, and 
during the approach or departure of 
visiting vehicles. 

The Service Module alone has 
12 windows, most of which are 
Earth facing. Other Russian Segment 
modules contain a number of 
windows, as well. Each US Segment 
hatch also has a window, although 
most windows on closed hatches 
are usually covered by a protective 
blanket on the outside or by stowage 
bags on the inside, meaning that the 
crew rarely uses the hatch windows 
for viewing. The primary purpose 
of the hatch windows is to view 
incoming modules (reference the 
“Finding Ready to Latch” section of 
this chapter). Thus, an external flap 
is left closed over the window to 
protect it from orbital debris until a 
hatchway is intended to be connected 
to a new module. Hatchways are also 
highly convenient locations inside 
the ISS where crews can temporarily 
stow hardware that might be staged 
for an upcoming cargo vehicle. This 
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Figure 18. “The ‘Cupola’, attached to the nadir side of the space station, gives a panoramic view of our beautiful planet, ” said Expedition 25 Commander 
Doug Wheelock (shown in photo) about this module that has seven large windows. 


staged hardware usually covers the 
window of that particular hatch. 

That leaves three primary window 
locations for viewing events outside 
the US Segment of the ISS for 
research, educational events, or 
crew viewing and photography. The 
US Laboratory has a single, large- 
diameter window (Figures 19-21). 
Research experiments are mounted 
into the Window Observation Rack 
Facility, which is installed over the 
top of this window, thus enabling 
detailed observations of Earth. The 
JEM has two large-diameter windows 
on its port bulkhead; these windows 
are used to monitor operations of the 
JEM robotic arm, activities on the 


JEM Exposed Facility, and operations 
of the JEM Airlock. The Cupola is a 
module of windows attached to the 
bottom of Node 3 (Figure 18). It has 
one large, round window at its center 
and six trapezoidal windows around 
its perimeter to provide a breathtaking 
bay-window view of Earth. The 
Cupola is used by the crew not only 
for Earth viewing, but also to monitor 
the arrival and departure of visiting 
vehicles as well as EVAs and robotics 
occurring on the bottom of the ISS. 

The Earth-facing science window 
in the US Laboratory was specially 
designed and manufactured to support 
scientific investigations. This was 
accomplished through specific and 


fine polishing specifications, and 
through application of coatings on 
the glass surfaces (as well as specific 
decisions on which coatings to leave 
off the window). This detail on the 
US Laboratory window enables 
excellent optical qualities that 
allow the use of various cameras 
and telescopes that operate in both 
the visible and non-visible light 
wavelengths. The windows in the 
Laboratory, JEM, and Cupola, as 
well as many of the windows in the 
Service Module, are also protected 
with shutters to ensure as little debris 
as possible makes its way onto the 
high-quality optical glass. These 
shutters—some manually controlled 
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How big are 
the windows? 


Size (diameter) of common 
ISS windows: 


US hatch: 

20.3 cm (8 in.) 

US Laboratory: 
51 cm (20 in.) 

JEM (two): 

51 cm (20 in.) 


Cupola center: 
70.6 cm (27.8 in.) 


Cupola trapezoidal (six): 
0.2 2 m area (322 in 2 ) 


Service Module Window #9: 
48.3 cm (19 in.) 


Figure 19. Expedition 8 Commander Mike Foale using the Ultrasonic Leak Detector in 2004 to 
pinpoint a small leak that had developed in one of the seals of the hose used to maintain a vacuum 
between the panes of glass within the large window of the US Laboratory. Once the leak point was 
identified, the hose was disconnected (which stopped the leak to space) until a replacement hose could 
be flown to the space station. 


Figure 20. The US Laboratory window with its shutter closed (noted by white cover visible through the 
window) and protective box covering its vacuum flex hose. Clockwise from the box is the handwheel 
crews use to open and close the shutter. 


and some electrically controlled— 
serve to reduce the exposure of the 
outer window pane to contamination 
from jet firings or material off¬ 
gassing, provide debris shielding for 
that outer pane, and block sunlight 
from entering the ISS cabin. 

None of the windows on the ISS are 
composed of a single pane of glass, 
nor is each pane as thin as one found 
in a home window. Rather, two panes 
of relatively thick glass maintain the 
pressure integrity of the module and, 
typically, there are additional thinner 
protective panes on the inside and 
outside of the window. That makes 
for a total of four panes. The inner 
protective pane (called the “scratch 
pane,” as it is intended to prevent the 
crews from inadvertently scratching 
the glass pressure pane) can be 
removed if necessary. A vacuum is 
drawn on the inter-pane space to 
prevent condensation from forming 
between the two panes of window 


glass. That is the purpose of the flex 
hose that Mike Foale is inspecting in 
Figure 19. That flex hose also proved 
to be an inviting hand hold for early 
ISS crew members; over time, this 
resulted in the development of a 


small leak in that hose. A protective 
box has now been installed over 
these flex hoses to ensure they do 
not get bumped and start leaking, as 
shown in Figure 20. 
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Window Assembly Components 


Internal Pressure 
Cover 



Debris Pane 
Assembly 


LAB Structure 


External Pressure 
Cover 


Window Panes 


Flex Hose- 
Used to maintain 
vacuum between 
the two Pressure 
Fanes* 


Scratch Pane 


internal Pressu re Cove/ and 
Bf Earns/ Preis^re Com are 
not nominalfy instated, 
internal Pressure Cover is 
j ontnuod in eng evert/ of a 
pane fatfune or pane sea/ 
leak. External Pressure 
Cover ft installed when 
mptacfng a window pane. 


Window Shutter 

Handwheel 

Assembly 


Window Shutter 



Pressure Panes 


Figure 21. Overview of the US Laboratory window. Note that the flex hose was the source of the leak discussed in Chapter 16. 


The design concept of these windows 
is that any high-velocity debris 
would hit the outermost debris pane, 
followed by the outer pressure pane. 
If the debris were going fast enough 
to break through both panes, the 
particles would be slowed enough 
such that they would not penetrate 
the inner pressure pane. As shown 
in the diagram in Figure 21, this 
design is similar to the Whipple 
Shield design of the module debris 
shields described earlier. The smaller 
windows on the ISS, such as the US 
hatch windows, have the same dual¬ 
pressure pane design concept as well 
as inner and outer protective covers. 


The windows of the US hatches, 

US Laboratory, JEM, and Cupola are 
designed to be replaceable in the event 
a window pane breaks. An astronaut 
would install an external pressure 
cover over the window, via an EVA, 
to replace the windows exposed to 
space. The window would then be 
removed from the inside of the ISS. 
The windows themselves cannot be 
removed by a spacewalking astronaut; 
the removal must be done from the 
pressurized environment of the ISS 
cabin. Thus, if debris were to damage 
both panes of a window and cause a 
module to depressurize, it would not 
be possible to replace that damaged 


window. Instead, the crew would 
install the external pressure cover, via 
EVA, and repressurize the evacuated 
module. The crew could then go into 
that module and remove the window. 

With the window removed, the 
crew would install an internal 
pressure cover over the window’s 
hole until the new window was ready 
to be installed. The pressure covers 
are on orbit to provide a means to 
respond to a broken window pane; 
however, no spare windows are kept 
on board the ISS. A spare would 
need to be manufactured and flown 
after the failure. 
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Racks 

With a pressure shell, protective 
debris shielding, and windows in 
place, it is time to discuss a piece of 
the ISS modules with which crews 
interact on a continual basis. In the 
US Segment, the cylindrical modules 
are broken up into four quadrants. 
For each module, there is a floor 
(“deck”), ceiling (“overhead”), a 
left side (“port”), and a right side 
(“starboard”). An empty square¬ 
shaped space runs the length of the 
center of each module; this is where 


the crews live and work (Figure 22). 
A series of racks separate the pressure 
shell from the crews’ living and 
working space. 

The numerous types of racks on the 
ISS can be broken down into four 
major categories. The avionics racks 
contain the computers, fans, power 
converters, air conditioners, etc. 
that are required to keep the vehicle 
functioning and the crew alive. 
Payload racks house the various 
science facilities and experiments that 
are conducted. Crew support racks 


contain items such as the galley, food 
refrigerators, food warmers, and the 
toilet. (See Figures 23 through 28.) 
Finally, there are stowage racks. 

Given that stowage space is at a 
premium on the ISS, the crew can 
find stowage spaces not only in 
dedicated stowage racks but also in 
various compartments in all the other 
racks. Stowage space is also found in 
standoff areas, endcones, hatchways, 
and pretty much any other nook and 
cranny that may not have an alternate 
dedicated use. 



Figure 22. Cosmonaut Sergei Krikalev, flight engineer for the Expedition 1 crew, floats in the US Laboratory shortly after it was installed on STS-98/ISS-5A 
(2000). The four walls are actually the front faces of different racks. Note the empty central corridor. This photo was taken before the numerous science racks 
were launched and installed in the Laboratory. 
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Figure 23. A view of the JEM from its Airlock looking starboard toward Node 2 and Columbus. The camera taking this photo would be in Bay 7 of the JPM. 
The JPM1F2 location would be the second rack bay from the hatch on the forward wall (which is to the left in this picture). That means it would be the rack 
bay covered by the white fabric panel on the left side of the image, second rack bay from the blue wall/hatchway. 


The rack concept for the US 
Segment hearkens to similar 
concepts in use in laboratories and 
research facilities on Earth. Using 
standard interfaces—i.e., interfaces 
between rack and module as well as 
those inside each rack—allow for 


relatively simple and straightforward 
interchangeability of avionics and 
research experiments throughout 
the US Segment. Each rack on the 
ISS is held to the structure of its 
ISS module by four points—one 
at each corner of the front of the 


rack. As shown in Figure 23, spaces 
exist between the top of one rack 
and the bottom of the next. Lights, 
ventilation grids, power outlets, and 
other equipment are installed in these 
areas of each module. These standoff 
areas are also where the racks 
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Figure 24. Astronauts Ken Ham (top), STS-124 pilot, and Greg Chamitoff, Expedition 17 flight engineer, install various racks in the JEM module after it was 
attached to the ISS on STS- 124/ISS- 1J (2008). Some of the racks were launched in one location due to orbiter center of gravity requirements and needed to 
be moved to their final locations after the module was attached to the ISS. 


attach to the module. Pivot pins are 
installed at the bottom of the rack. 
This configuration allows the crew to 
detach the two attachments at the top 
of the rack and rotate the rack on its 
two pivot pins. This gives the crew 
generally simple access to the back 
of the rack and to the pressure shell 
of the module. This easy access is 
important in the event the crew needs 
to look for hull penetrations caused 
by orbital debris. 

Of course there is no “up” or “down” 
in zero gravity, so how do the crews 
remain properly oriented? All of 


the lights within the module are 
overhead and the air return grilles 
are on the deck. The walls are port, 
starboard, forward, or aft, depending 
on where the module is located on 
the ISS. (This system works well 
for horizontal modules but can still 
be confusing in the vertical modules 
such as visiting cargo vehicles.) 
When dealing specifically with a 
rack, all references are made with 
respect to the crew member facing 
the rack with his or her feet being 
toward the pivot brackets. That way, 
the crew member always knows 
where the top of the rack is located. 


It can still be confusing to find 
places inside the ISS because it is so 
large. For that reason, the ISS as a 
whole has a common location coding 
scheme. The system for identifying 
a location inside a pressurized 
module includes the name of the 
module, the rack bay, the particular 
rack in that bay, and even a locker 
within that rack. 

For example, the location code 
JPM1F2D1 would be Japanese 
Pressurized Module (JPM)l (i.e., 
JPM1—commonly called the JEM), 
Forward 2 (second rack bay from 
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Figure 25. An example of an avionics rack. This is 
the Moderate Temperature Thermal Control System 
rack (see Chapter 11) in the US Laboratory with its 
closeout panels removed, prior to it being installed at 
the LABIS6 location. On the left side of this rack is a 
fluid pump that is covered by black insulation. On the 
right half of this rack is a heat exchanger (top half) 
and cabin fan (bottom half) that, together, make up 
one of the Laboratory’s air-conditioning systems. 



Figure 26. A payload rack, Expedite the Processing 
of Experiments to the Space Station (EXPRESS) 4, in 
the US Laboratory module during Expedition 4 (2002) 
prior to it being relocated to the JEM. An EXPRESS 
rack has a number of locker locations where smaller 
payloads can be installed; these payloads can get 
power and data from the central area of the rack. The 
smaller locker payloads can be exchanged regularly, 
and can even be returned to the ground, if necessary. 



Figure 27. The Waste and Hygiene Compartment (WHC), located at N0D3F4, is an example of a 
rack designed for crew support. The WHC is the bathroom for the US Segment. To use this facility, 
crew members close a privacy curtain (located approximately where the camera was located to 
take this photo). Liquid waste enters a funnel at the end of the hose, as seen in the upper-right 
corner of the above image. Solid waste goes into the solid waste receptable (metal can), as seen in 
the middle of the image. Liquids and solids are drawn into their respective destinations by airflow 
from a fan that runs when the WHC is powered on. 
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Figure 28. The Fluids Integrated Rack (FIR) at LABIS4 is an example of a payload facility rack. 
Here, Expedition 29 Commander Mike Fossum works on an experiment inside the glove box that is 
part of the FIR rack (2011). 


the center of the ISS, the rack on the 
forward wall of that rack bay), locker 
D1 (a label is located on each locker 
location; A and B are at the top of the 
rack). This common location coding 
system is also used as part of the 
Inventory Management System, thus 
enabling all equipment on the ISS to 
be tracked to a specific location. 


Closeouts 

Many of the racks and standoffs 
have closeout panels installed to 
keep the ISS looking nice, to avoid 
numerous open holes and places 
for items to get lost, to aid proper 
airflow through the station, and to aid 
in fire suppression and prevention 



Figure 29. European Space Agency Astronaut Leopold Fyharts, Expedition 16 flight engineer, holds a closeout panel in the newly attached Columbus 
laboratory during the STS-122/ISS-1E (2008) mission. This panel bears the names of European engineers who built Columbus. Note the other white closeout 
panels—both hard panels and soft fabric panels—inside Columbus. 


58 


CHAPTER 3 SYSTEMS: STRUCTURE AND MECHANISMS-THE INTERNATIONAL SPACE STATION’S SKELETON 











(Figure 29). These panels, held 
in place by a few fasteners (that 
sometimes get stuck and need to be 
“convinced” to open), serve to close 
out open spaces and provide a good 
aesthetic for each module. 


Conclusion 

The structures of the ISS provide 
the critical role of creating a stable 
platform for the completion of the 
space station’s mission of scientific 
research and preparation for 
exploration beyond Earth orbit. The 
buildup of the ISS over time and 
numerous international launches 
created both unique challenges and 
unique opportunities that have led 
to a diverse and highly capable 
structure. The remaining chapters will 
explain how crew and ground teams 
have used the capabilities provided by 
these structures to ensure the crews 
remain safe in their orbital home and 
are able to perform their missions. 
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Chapter 4 Day in the Life: 

The Making of 
a Mission 




The STS-130/ISS-20A crew mission patch. Since the Cupola was a major new module, the perspective 
represented here is the view of Earth from inside the module. 


When all goes well\ most space 
missions do not garner any 
real headlines or discussion in 
the media . This absence of coverage 
understates the amount of effort that 
goes into making a mission successful. 
All missions to the International 
Space Station (ISS) possess common 
characteristics. This chapter illustrates 
this process by telling the story of 
a “typical” ISS assembly mission. 
During assembly missions, Space 
Shuttles rendezvoused with the ISS, 
crews transferred hardware (often a 
completely new module), astronauts 
conducted multiple spacewalks (i.e., 
extravehicular activities [EVAs]), and 
NASA and its partners established 
new capabilities. A team of flight 
controllers, with Boeing engineering 
support, worked around the clock 
during each mission to ensure 
everything went as planned, and to 
intervene when it didn’t. The orbiter 
would return to Earth after about 
2 weeks, leaving the increment 
crew behind to carry on while flight 
directors and controllers working with 
the ISS Program Office prepared for 
the next mission. 

Planning for such a mission began 
several years in advance. Initially, the 
program office detailed high-level 
objectives that drove the specifics 
of the mission. Approximately 
1 year prior to launch, a group of 
controllers, led by a flight director 
whose full-time job was to prepare 
for the mission, detailed development 
of the mission timeline, wrote flight 
rules and procedures, and planned 
EVAs. A flight director and a team of 
controllers were each assigned for the 
two sides of a mission: Space Shuttle 
and ISS. These represented the prime 
teams for the mission. In addition, 
another team was assigned to the ISS 
increment (see the “Planning” section 
of this chapter) where the mission 
was scheduled to take place. The 


three flight directors worked closely 
together to ensure everything was 
integrated on both programs. 

Change was ever-present in the 
process of preparing for a mission as 
priorities and needs shifted such as 
when a major component on the ISS 
required repair. In fact, change was 
probably one of the most significant 
issues a flight director confronted in 
preparing for a mission. Needs and 
objectives changed constantly as a 
mission evolved: schedules might 
have slipped; critical hardware 
could have broken, thus requiring 
immediate replacement; or a failure 
on the space station may have driven 
a late change. Therefore, the teams 
had to continuously adapt. 

Attention to detail, in any plan, is 
critical. Careful planning and vigilance 
reduces the chance of surprises or 
failures. Even so, the flight director 
and the team spent many a sleepless 
night during the assembly missions 


wondering “What did we not think 
of? What could possibly go wrong?” 
Inevitably, things did go wrong. 
Frequently things went wrong that no 
one had ever considered. When this 
happened, the experience, training and 
preparation of the crew and the flight 
control team came together to resolve 
those problems as quickly and as 
safely as possible. 

Training was next. Once the timeline 
was developed in significant detail, 
flight control teams and crews 
simulated the mission’s critical 
activities. The Space Shuttle flight 
control team conducted a number of 
simulations with the shuttle crew, 
focusing primarily on launch and 
possible aborts. Likewise, the ISS 
flight control team assigned to the 
mission practiced activating the 
module or other key tasks. However, 
the increment crew members that 
would be present during an assembly 
mission were often scattered 
around the world, preparing for 
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their increment or, in some cases, 
already on board the ISS during 
these flight-specific simulations. 
Generic increment crews, often 
composed of astronauts who had 
already been crew members on the 
ISS, played the parts of the actual 
crews in these simulations. Space 
Shuttle missions often changed 
launch dates and sometimes even 
order (see Introduction). Therefore, 
multiple increment crews might 
have needed to prepare for the same 
shuttle mission, thus making training 
even more challenging. Both teams 
conducted several simulations, called 
“joint sims,” to rehearse integrated 
tasks such as rendezvous or handing 
off the module between the robotic 
arm of the orbiter and the arm of the 
space station. Once a mission was 
under way, the ISS increment team 
ceded responsibility to the prime 
station team and therefore did not 
participate in the joint training. The 
members of the training team were 
very much part of the team, and they 
would review the timeline and look 
for issues to help the flight controllers 
succeed during the flight. 

Execution of the mission followed 
all the training and preparation. 

The execution phase—also called 
“Fly”—included some of the most 
intense and longest days faced by the 
flight control teams. Tension built 
prior to launch since a critical number 
of operations were about to occur. 
However, if everyone had done their 
job, the teams were well prepared 
to handle any situation. The flight 
control teams tried to take a couple 
of days off before launch to rest and 
close out the last few details. 

The 130th shuttle mission/32nd 
ISS assembly mission—Space 
Transportation System (STS)-130/ 
ISS-20A—took place over a 13-day 
timespan in February 2010. The 
core objective of the mission was to 


attach the new Node 3 and Cupola 
modules. The success of this and 
many other tasks rested on the 
shoulders of a highly competent and 
passionate team that spent years 
working to make it all happen. Most 
of the challenges encountered along 
the way actually occurred on the 
surface of the Earth. Each challenge 
was resolved, often in parallel, as the 
team prepared for the actual mission. 
With the impending retirement of the 
Space Shuttle, it was a mission that 
might never have happened. 


Planning 

The assembly sequence of the ISS, 
as discussed in the Introduction, 
underwent many changes over the 
years. Once the plan laid out the 
order of module assembly, the Space 
Shuttle Program personnel managed 
the complicated logistics years in 
advance to ensure that an orbiter with 
the right capability (e.g., light enough 
for a heavy payload) was available 
for the right mission. More detailed 
preparation began a few years out 
from a planned mission. In the case 
of 20A, NASA assigned the core of 
the ISS flight control team in the fall 
of 2007 to a mission that, at the time, 
was possibly going to be the final 
shuttle flight. The crew would be 
assigned about 1 year prior to launch. 
The STS-130/ISS-20A mission was 
tasked to accomplish four primary 
objectives during an estimated 11-day 
mission, as defined by the Space 
Shuttle Program and ISS Program. 
These objectives included: 

■ Launch the orbiter with Node 3 
module and Cupola 

■ Install Node 3 module on the 
ISS (but do not activate or 
connect anything) 

■ Transfer critical items 


■ Land the orbiter 

During one or more space station 
increments after the mission, the 
following would be accomplished: 

■ Attach the power and cooling lines 
from Node 3 to the main systems 
of the ISS 

■ De-mate the Cupola from its launch 
configuration, at the end of Node 3 
module (required for it to fit into the 
orbiter’s cargo bay, see Figure 2 in 
Chapter 3), and attach it the nadir 
side of the module 

■ Relocate all the regenerative 
life support systems and exercise 
equipment to Node 3, which 
was located throughout the US 
On-orbit Segment 

About 12 to 18 months in advance of 
an assembly mission, NASA assigned 
a lead from each Space Shuttle and 
ISS discipline. The lead’s job was 
to oversee every aspect of his or her 
system throughout the process of 
developing, training for, and executing 
a mission. This included training the 
astronauts—both the ISS expedition 
and the Space Shuttle crews. A 
designated flight director led and 
directed each team during the mission 
development as program requirements 
and objectives were translated into a 
timeline, flight rules, procedures, and 
crew training. Besides being the point 
of contact for developing the plan, the 
discipline lead typically worked the 
primary console shift for the mission. 
Usually, the lead was a senior flight 
controller who had supported multiple 
previous missions as an off-shift 
controller, a backup to a mission 
lead, or a backroom controller (see 
Introduction) before being assigned 
a mission of his or her own. Some 
flight controllers had the privilege 
of working multiple missions as a 
lead over the course of their careers. 
Typically 6 to 12 months in advance 
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of a mission, the teams of a flight 
controller and a flight director would 
be assigned for the other two shifts 
(missions always worked with three 
9-hour shifts around the clock). 

Several flight controllers had to be 
assigned more than 2 years prior to 
the STS- 130/ISS-20A mission. These 
assignments included the leads for 
EVA, Operations Support Officer 
(OSO), and the Environmental Control 
and Life Support System (ECLSS). 
The lead EVA officer is usually one 
of the first to be assigned to a mission 
because spacewalks take a long 
time to plan, train for, and execute. 
However, the lead OSO would also 
be busy on this flight because the 
STS-130/ISS-20A mission involved 
a lot of hardware changes and the 
berthing of a module. In fact, because 
the OSO task was so large, several 
people were assigned at an early stage, 
including one whose main job was to 
focus on the Node 3 module whereas 
a separate person focused on the 
Cupola. Major changes to the ECLSS, 
including additional components in 
the regenerative environmental control 
system, were scheduled to occur 
during and after 20A. 

Normally, mission preparation ramped 
up slowly as the plan was developed, 
first taking the major objectives 
listed above and creating a timeline 
as tasks were added. Preparation for 
20 A got off to a busy start as the ISS 
Program officials considered changing 
the location of Node 3 on the ISS. 
Originally, the module was to hang 
down in the nadir direction, pointing 
toward the Earth with the Cupola 
facing forward (the direction the ISS 
flies around the Earth), as shown 
in Figure 1. In this configuration, 
NASA’s crewed vehicle, Orion, and 
the Japan Aerospace Exploration 
Agency’s uncrewed cargo ship, H-II 
Transfer Vehicle (HTV), were to 



Figure 1. Initially, the Node module was supposed to project nadir (teal blue silhouette); however, it 
was changed to the port side. The Cupola would be launched on the end of Node 3 to fit in the cargo 
bay of the orbiter, and then relocated to its permanent position through use of the robotic arm. Inset: 
launch configuration of the module pair with Cupola on the end of Node 3. 
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Figure 2. Drawing of the ISS now showing Node 3 berthed on the port side (red outline). 


be attached to the space station at 
the nadir side of Node 3. But it was 
realized that interference could occur 
with the Russian Mini-Research 
Module projecting nadir from the 
Functional Cargo Block module. 

The nadir of the Mini-Research 
Module was also to be the location 
for the Soyuz and, possibly, Progress 
vehicles. Although visiting vehicles 
such as HTV, Orion, and Soyuz could 
likely dock and undock with no 
interference, the ISS Program officials 
decided to ensure a certain amount of 
clearance due to unexpected errors, 
uncertainties in sensors, or systems 
failures. A miscalculation could cause 
a collision (similar to when a Progress 
vehicle struck the Russian Mir station 
in 1997 with US astronaut Michael 
Foale on board), destroying a module, 
or worse, the entire station. 

To solve the clearance issue, ISS 
Program officials asked whether 
Node 3 module could be installed on 
the port (left) direction off of Node 1, 
as shown in Figure 1. Although the 
berthing mechanisms were designed 
to allow a module to be mounted in 
any orientation, the plumbing to that 


module was not as accommodating. 
All of the ventilation lines, computer 
circuits, water tubes, nitrogen lines, 
and communication cables had been 
installed years earlier in Node 1 under 
the assumption that Node 3 would 
be on the nadir. To place Node 3 on 
the port side meant all these had to 
be rerouted—in space. Furthermore, 
the electrical power cables and the 
external ammonia lines used for 
cooling the Node electronics would 
have to be rerouted. Figures 1 and 2 
show the final proposed configuration. 

As was typical of the flight control 
and engineering teams, the question 
was not whether they could do this, 
but how they could make it work. 

The first task was to figure out how to 
modify the Node 1 module that was 
already on orbit to accommodate the 
change and make sure the hardware 
and procedures could be done by the 
ISS crew. The task was analogous 
to modifying a bedroom by moving 
the bathroom to the other side of the 
room. The changes also would have 
to be somehow verified in advance 
to ensure that everything aligned 
just right when Node 3 was installed 


during the mission. Node 1 was 
already in orbit, so no direct fit checks 
could be performed. The teams had 
to use the Node 1 mock-up in the 
training facility. The mission would 
be a complete disaster if the shuttle 
was launched and then Node 3 could 
not be physically mated to Node 1. 
Even if the modifications to Node 1 
could be made, they had to be done 
in the limited time available to the 
astronauts with the training that could 
be accommodated in the already- 
packed training schedules. If the 
modifications were not completed 
before NASA retired the Space 
Shuttle fleet, Node 3 module might 
never make it to orbit. 

The first of many issues arose as this 
was being worked out. Although 
the berthing mechanism could, in 
principle, accommodate a module 
in any one of four orientations 90 
degrees apart, bumpers existed on 
both modules to provide additional 
protection when two modules were 
mated. The result was that Node 3 
could only be installed in two of four 
orientations on Node 1. Either option 
had the module lights on the back 
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wall (i.e., away from the direction 
of motion) or the forward wall (i.e., 
toward the direction of motion) from 
a crew perspective. This seemingly 
minor issue was an important one for 
the crew. No “up” or “down” exists 
in space; therefore, any reference 
frame is artificially introduced. The 
lights on all of the other modules 
were in the same orientation (on the 
“ceiling”) to provide an “up.” If this 
one module was different, it could be 
disorienting for the crew, especially 
during an emergency where visibility 
was greatly reduced due to smoke. If 
the node was rotated 90 degrees, the 
lights would again be on the “ceiling.” 
To do this, the bumpers from Node 3 
would have to be removed and the 
plumbing would have to be rerouted a 
little differently on Node 1. Removing 
the bumpers was relatively easy 
with Node 3 still on the ground. 

Since the plan was to gut Node 1, it 
really didn’t matter where the lines 
were routed; therefore, changing the 
destination by a few more feet was 
not an issue. The biggest roadblock 
was actually external. 

Two boxes—InterFace Heat 
exchangers (see Chapter 11)—are 
located on the outside of Node 3 
where the cool ammonia on the 
outside removes heat from the internal 
water lines. In the new orientation 
for Node 3, an astronaut would not 
be able to replace these units due 
to interference from the Laboratory 
module (Figure 3). Although the 
likelihood of a failure was estimated 
to be one failure in 29 years of 
continuous operation, the impact was 
significant: if either one of these heat 
exchangers actually failed, half the 
systems in Node 3 would have to be 
shut down permanently. In 2007, the 
hope was that the ISS would be flying 
until at least 2028; therefore, the risk 
was real enough to spend some time 
considering the overall situation. 



Figure 3. A computer- 
aided design drawing 
showing an astronaut 
working on Node 3 heat 
exchanger with the 
Laboratory module over 
the left shoulder. Note 
that there are just a few 
centimeters (inches) 
of clearance between 
the astronaut’s life 
support backpack and 
the Laboratory module. 

It would be nearly 
impossible to work in 
such a small area without 
banging into the module 
and possibly damaging 
the spacesuit. 


With support from the engineering 
community, the flight control team 
began to work out a plausible repair 
scenario. If a heat exchanger needed 
to be repaired, the team could unberth 
Node 3 using the robotic arm, rotate 
it 90 degrees, rebirth it temporarily, 
perform the repair, and return it to its 
normal configuration. This also meant 
the crew would have to disconnect 
the external ammonia cooling and 
electrical power lines before the 
operation started, and reconnect 
them when done. At least two 
EVAs would be added to any repair 
operation, in addition to potentially 
exposing the crew to toxic ammonia. 
This whole process would not be a 
trivial operation since everything in 
Node 3 would have to be shut down 
for days, if not weeks, while the crew 
conducted multiple spacewalks and 
never-before-performed robotics 
operations. Since Node 3 would house 
many of the vital life support systems, 
shutting it down for any length of 


time would impact the mission. The 
solution was to lengthen the electrical 
lines significantly so that they would 
not have to be disconnected (the 
ammonia lines already had enough 
slack in them to remain connected). 
This complicated pas de deux took 
several months to work out with 
confidence, and included several 
test dives in the Neutral Buoyancy 
Laboratory (NBL). Once the team 
was comfortable that this repair could 
be performed, if ever needed, it was 
agreed to reorient the module to make 
it seem more natural for the crew. 

Making the modifications to Node 1 
would require extensive work. The 
OSO team estimated that at least 
120 man-hours would be needed to 
modify Node 1 on orbit. To add to 
the difficulty, some tasks could not 
be performed prior to the installation 
of Node 3. For example, water and 
oxygen lines run between the modules 
(see Chapter 3). If Node 3 was ever 
struck by debris and depressed, the 
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crew needed to be able to close the 
hatch to preserve crew members and 
the rest of the ISS. Therefore, these 
oxygen and water lines could not run 
through the hatchways. The lines are 
actually located within the aluminum 
structure of Nodes 1 and 3, passing 
through what is called the bulkhead. 
The required modifications to Node 3 
were made prior to launch. However, 
for Node 1, this meant the crew had 
to make new holes in the port side, 
reroute the lines, reseal the bulkhead, 
and carefully check for leaks to 
ensure the integrity of the new seals. 
To perform the leak checks, the crew 
first needed to make the modifications 
and then measure for leakage on 
both sides of the seal. This was not 
possible without Node 3 in place. At 
that time, the other side of the wall 
of Node 1 was a vacuum. Per the 
initial mission plan, Node 3 would be 
installed and the crew would perform 
the modifications after the shuttle left. 
This meant, however, that the many 
hours needed to activate and outfit the 
module would have to be performed 
by three people—without the benefit 
of the seven extra astronauts that were 
available during a shuttle mission. 

The flight control team came up 
with an interesting proposal. A 
small connector module called the 
Pressurized Mating Adapter (PMA)3 
resided on the ISS. Atlantis docked 
with PMA3 during the STS-98/ 
ISS-5A mission, but the module 
was not currently being used. This 
module could be moved by the 
robotic arm and installed on Node 1, 
thus providing a pressurized area 
in which to make the changes. The 
module would be moved back to its 
original location upon completion 
of the modifications. If the 120 
hours of crew time could be found 
during the increment for this task, 
the modifications to Node 1 could 
be performed prior to the ISS-20A 


mission. This meant Node 3 could 
be connected and activated during 
the flight (i.e., “plug-and-play,” 
as the team called it) when those 
extra sets of hands are available. 

As with the change in the port 
location of Node 3, this had to be 
carefully coordinated and reviewed, 
especially since it meant taking the 
expedition crew away from research 
during the increment. However, 
a little investment in the time of 
the increment would significantly 
increase the larger shuttle crew’s 
efficiency. The more tasks completed 
during the shuttle mission, the less 
work for subsequent increments. 

This resulted in a net gain of 
increment time in which to focus 
on research. Many reviews and 
meetings later, the idea was given 
approval by the ISS Program. 

Originally, the modification hardware 
was to go up on 20A because it would 
be installed after the flight. With the 
new plan, the design, fabrication, 
and testing had to be accelerated 
to go up on an earlier shuttle flight. 
This proved to be a real challenge to 
the Boeing team members, but they 
worked extremely hard to pull this off. 

Another challenge discovered at this 
point was that the planned route of 
the power cables would be blocked 
as soon as Node 3 was installed. 
Therefore, the power cables had to 
be installed prior to the 20A mission. 
The STS-128/ISS-17A team members 
picked up this task because they had 
some spare EVA time. 

In 2008, the timeline leading to 
20A changed to the following series 
of events: 

■ During the interval following the 
second Japanese/American mission, 
STS-127/2 J/A, the ISS crew would 
move PM A3 from Node 1 nadir 
to Node 1 port using the station’s 
robotic arm 


■ On STS-128/ISS-17A, the crew 
would route the power cables from 
nadir to port during an EVA 

. After STS-128/ISS-17A, some 
Node 1 modification work 
would begin if the parts could be 
accelerated to be ready in time 

■ STS-129/ISS-Utilization 
Logistics Flight (ULF)-3 would 
bring up the remainder of the 
Node 1 hardware and finish most 
of the modifications 

. After ULF-3, the PMA3 would 
be relocated back to its pre-2 J/A 
location on the nadir of Node 1 
by the ISS crew, again using the 
station’s robotic arm. 

■ 20A crew would install Node 3 

The 11-day mission now looked 

like this: 

■ Launch the orbiter with Node 3 
and Cupola 

■ Install Node 3 on the ISS 

■ Install ammonia lines, activate the 
module, and integrate the ammonia 
cooling into the system 

■ Transfer critical items 

■ Land the orbiter 

Finally, the following would be 

completed after the mission: 

■ Relocate the Cupola from the end 
cap of Node 3 to its permanent 
nadir location 

■ Relocate the life support systems 
into Node 3 and activate 

■ Move the Advanced Resistive 
Exercise Device into Node 3 

■ Move the Treadmill 2 (T2) into 
Node 3 
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Spacewalks 

The spacewalk plan for the mission, as 
dictated by the key mission objectives, 
was evolving as well. To help preserve 
the limited oxygen on the ISS, it was 
preferable to perform spacewalks 
during Space Shuttle missions so that 
the tanks could be topped off before 
the orbiter undocked. Therefore, 
the ISS Program officials preferred 
to schedule as many spacewalks as 
practical during a docked mission. 
Over the life of the ISS assembly, 
the number of spacewalks grew 
from one, to two, and sometimes 
three during shuttle missions. By the 
fall of 2008, three spacewalks were 
standard, as shown in Figure 4. Tasks 
similar to those performed during 
previous missions were well known 


and their time estimates were pretty 
accurate. For new tasks, however, the 
performance estimate was usually 
pretty conservative until dives in the 
NBL could provide a better indication 
of the required time. 

The first EVA accomplished removing 
Node 3 from the orbiter cargo bay 
and berthing it on the ISS. The first 
thing the crew did was disconnect 
the Launch-To-Activation (LTA) 
jumpers. The LTA jumpers provided 
power to the heaters in the module, 
thereby keeping the hardware from 
freezing until the Thermal Control 
System was fully functional. The 
protective flap covering the hatch 
window (see Chapter 3) needed to 
be opened to allow the crew that was 
using the Centerline Berthing Camera 


System to see the incoming Node 3. 
The shuttle crew used the SSRMS to 
grapple Node 3 (see Chapter 15) and 
move it into the berthing position. 
Although a number of small tasks 
needed to be done on the outside of 
Node 3 (e.g., installing hand holds 
used for future spacewalks), this 
could not be done while the SSRMS 
was moving the node. Therefore, 
the team needed to find other tasks 
to fill this large gap in the timeline. 
Once the module was berthed, the 
astronauts reconnected the critical 
LTA cables. These tasks consumed 
all of the time available for the first 
EVA. In fact, it took so long to move 
and bolt the module that the team ran 
the risk of running out of time before 
completing that task. 
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Figure 4. STS-130/ISS-20A EVA timeline from October 2008. Note that there is still open time on the first spacewalk since the crew could not touch Node 3 
while the Space Station Robotics Manipulator System (SSRMS) was maneuvering Node 3 into position prior to mating to Node 1. The Launch-to-Activation 
(LTA) cable, which is used to keep the module from freezing, is disconnected during the installation and reinstalled at the end of the first spacewalk until the 
internal systems can be activated on a later mission day. The loop A and B Quick Disconnects (QDs) indicate where the ammonia lines are integrated into 
each of the cooling systems. One astronaut would be on the end of the SSRMS during the removal of the Multilayer Insulation (MU) that protected the Cupola 
until it was activated, as well as the removal of the locks that held the protective windows in place during ascent. Note that the timeline mentions jettisoning 
the MU, but this was later deleted in case the insulation was needed in the future (i.e., in case the Cupola had to be relocated). 
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The second spacewalk primarily 
focused on installing the ammonia 
jumpers along with the main power 
and data connections that had been 
previously installed on the outside 
of the ISS and routed. The ammonia 
lines had to be installed first for two 
reasons: it was the main objective 
of the spacewalk for that day; and 
ammonia could leak out when 
integrating the ammonia hoses with 
those already in use on the ISS. 
Ammonia is highly toxic and can be 
tricky to see. Just a little on one of 
the suits could kill the entire crew 
once the crew members got back 
inside. The EVA team developed 
complicated procedures to detect 
ammonia and clean the crew before 
opening the hatch. Among other 
things, the affected crew member 
had to sublimate the crystals off the 
suit using a warm metal tool. Then, 
he or she would float to a sunny spot 
in space and hang out for a while 
to allow any possible remaining 
ice crystals to evaporate. Once in 
the airlock after repressurization 
to 259 mm Hg (5 psi), the crew 
member measured the amount of 
ammonia in the air before fully 
repressing and removing his or her 
helmet. If ammonia was detected, the 
contaminated atmosphere would be 
vented overboard and fresh air would 
be pumped in. Again, the check 
was performed and repeated until 
it was safe for the crew. Since the 
spacesuits only had a limited amount 
of consumables (e.g., battery power, 
oxygen), time for these cleanup 
procedures (-90 minutes) had to be 
planned for in the timeline. 

At that point, only one more 
spacewalk was planned. The intent 
was to prepare the Cupola for its later 
relocation from its launch position 
to its permanent nadir location (see 
Figure 1). This meant removing the 


insulation and locking bolts on the 
external shutters that were required 
to prevent launch vibrations from 
causing damage. Since the insulation 
was large and bulky, the team decided 
to jettison it (i.e., throw it away in 
space so it would reenter Earth’s 
atmosphere and burn) rather than 
return it to Earth inside the shuttle. 
Since there was a chance that the 
Cupola might need to be moved again 
in the future, the team later changed 
this decision and the insulation was 
taken inside and stored on the ISS. 

As team members better understood 
the time required to perform 
each activity, they saw several 
opportunities to get ahead. In 
particular, they concluded that 
there might be time to perform the 
Cupola relocation. This task would 
benefit from the extra available 
shuttle astronauts, and its completion 
during the shuttle mission would 
reduce the crew’s workload in the 
smaller increment. Therefore, in the 
spring of 2009, the team added the 
Cupola relocation to the end of the 
second EVA. This also meant a quick 
activation of the module because 
electronics were needed to operate 
the berthing mechanisms and cooling 
was needed to prevent the electronics 
from overheating. Choreography 
would be tight. 

Integrating Node 3 cooling lines 
into the existing ISS systems meant 
shutting down those systems. As 
discussed in Chapter 11, the external 
cooling system is broken into two 
functionally redundant, separate 
loops—A and B. Choreography would 
then look something similar to this: 

■ Power down systems on loop A 

■ Turn off loop A cooling 

■ Astronauts to disconnect the 
hoses and integrate Node 3 lines 
on the A side 


■ Turn on loop A cooling 

■ Power up systems on loop A 

■ Verify everything is working 
properly 

■ Repeat for loop B 

This took a fair amount of time. 
Spacewalking astronauts had 
approximately 6.5 hours to conduct 
the EVA (see Chapter 17). Therefore, 
only one set of lines would be 
opened on this EVA. Next, the 
ground activated the key systems 
of Node 3. Once the module was 
basically working, the attachment 
mechanisms could be used to 
relocate the Cupola. Although this 
sounds straightforward, any glitch 
would derail the entire plan. The 
flight control team and training team 
began extensive work to refine the 
activation procedures and to train 
them very carefully. 

Remodeling 

With the current EVA timelines, 
some free time was still available 
during the mission. The ISS Program 
officials asked whether the team 
could move the PMA3 module from 
its current temporary position to its 
new home on the end of Node 3—i.e., 
the port end (Figure 5)—where the 
Cupola was located at the time of 
launch. After the robotics, EVA, and 
OSO teams assessed the proposal, 
a workable plan was developed; 
however, the plan required adding 
another day to complete the mission. 

Adding days to a shuttle mission 
required substantial analysis to 
ensure the supplies required for the 
seven-member crew could fit on the 
already busy and heavy mission. 

With the Space Shuttle Program 
winding down, the ISS Program 
was looking to take up as much 
equipment and supplies as possible. 
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Therefore, a trade occurred among 
supplies and hardware for the ISS, 
supplies for the shuttle crew for an 
extra day, and the amount of work 
those additional astronauts could 
perform in the allotted time. An 
additional factor was that as the 
mission got longer, the team had to 
allow the crew a day off to rest. 


Also around this time, the ECLSS 
team realized that with the many 
available hands of the shuttle and 
increment astronauts, significant 
progress could be made in relocating 
the regenerative life support and 
exercise racks that were destined to 
be installed. This promised to be a 
complicated task. Much of the US 
Segment life support system would 
have to be shut down, transferred, 
installed, and reactivated. This 
large amount of work had to be 
accomplished in as short a window as 
possible because of the critical need 
for life support and the additional 
demand of seven more people on the 
station at the time. Since the team 
had to add a day to the mission to 
relocate the PMA3, this provided an 
extra day to start the rack relocations 
(i.e., two crew would perform the 
PMA3 robotics operations while 
the remaining crews could work on 
configuring Node 3). It was assumed 
that the programs would find this 
worth the cost of adding supplies 
to the mission. By the end of the 
summer of 2009, the mission had 
grown to a 13-day mission. However, 
to be conservative and to allow for 
things going wrong, the additional 
day was considered optional and 
would be officially added to the 
timeline only during the flight if all 
was proceeding reasonably according 
to plan. If things did not work out 
well, these tasks would fall to future 
increments after the orbiter departed. 


Figure 5. The PMA3 relocated on the port end of Node 3 (top), showing the tight clearance 
with the radiator (bottom) where the brown shading illustrates the dynamic clearance envelope 
of the moving radiator. 
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Node 3 was closed off for a couple of 
days, and was therefore unavailable 
for the astronauts to begin any 
outfitting. If the crew could work in 
Node 3 and prepare the Cupola for 
relocation, this task could be done 
during the docked shuttle mission. 
Four key issues had to be overcome 
for this to occur. First, although the 
modules were constructed in clean 
rooms, there were always small bits 
of debris that could not be found and 
removed on Earth. Once in space, 
these particles float freely, posing 
an eye injury or inhalation risk. 
Therefore, for the new modules, the 
safety engineers required the fans be 
up and running for some time before 
the crew could ingress. In this way, 
the filters would have time to capture 
all the loose debris. The second 
concern was that carbon dioxide 
and humidity would build up inside 
Node 3 if no airflow was present 
in the module; furthermore, the 
buildup of humidity would result in 
condensation. Next, the module would 
be dark inside since the power would 
not be available for lights. A final 
issue was the inability to determine 
whether ammonia was somehow 
leaking into the cabin. Normally, the 
pumps and computers have sensors to 
detect the presence of ammonia. 

The ECLSS and Thermal Operations 
and Resources teams, with support 
from the BioMedical Engineer 
group and Boeing engineers, came 
up with workable solutions. The 
astronauts would wear eye goggles 
and surgical masks to prevent the 
debris from causing any injury, 
even though these options weren’t 
particularly comfortable. 

To solve the second issue, the ECLSS 
team combined gray tape with some 
unused ducting that was tucked 
away with another duct (one that 


was normally used to help pump air 
into the orbiter). This effort created a 
7-m (23-ft) long duct that would be 
relocated into the Cupola during the 
time the astronauts were inside. If the 
crew members were in Node 3, they 
were not going to be on the orbiter. 
Therefore, the duct was connected 
to an IntraModule Ventilation fan in 
Node 1 and dragged into the inactive 
Cupola vent. Note that any cables or 
hoses passing through a hatchway 
were normally not allowed because 
if a catastrophic cabin leak were to 
occur, the crew would have to be able 
to exit the module and quickly close 
the hatch. The ECLSS team worked 
out a plan with the astronauts so that 
this could be done quickly during the 
small window of time in which the 
astronauts were inside Node 3. 

Portable lights ensured visibility. 
Finally, the team analyzed and 
concluded that if the ammonia was 
not flowing through any of the 
cooling lines, the risk of a leak was 
acceptably low enough to allow the 
crew to be inside the module. This 
mission was evolving into one of 
the most challenging for the ECLSS 
team, as it had for the OSO team. 

With approval from both programs, 
work to add these tasks to the mission 
began in earnest. As with any task, 
the PMA3 relocation grew more 
complicated as the team worked out 
additional details. With the PM A3 
on the end (i.e., port side) of Node 3, 
the clearance between the farther port 
radiator panel and the module was 
going to be tight (Figure 5, bottom). 

In fact, at this point, the team didn’t 
even know whether there was enough 
clearance. When thousands of parts 
have been built by many different 
people from around the world, 
pinpointing the measurement of the 
final assembled structure was not an 


easy task. The size of all parts were 
recorded in drawings and in computer 
models, but verification was required 
to ensure everything was actually 
built as planned. Thermal expansion 
and, more critically, the flexing of the 
radiator panel as it moved also had to 
be taken into account. After careful 
calculation, engineers estimated that 
there was slightly more than 2 feet 
of clearance. Yet, that was true only 
if the calculations were right. In 
the event of a calculation error, the 
radiator and PMA3 could endure 
serious damage. 

The station team developed a 
conservative plan in case of 
calculation errors. After Node 3 
was installed on the ISS with the 
Cupola still positioned for launch, 
the robotic cameras took images 
that were used to measure the exact 
clearance. Although the PM A3 was 
different than the Cupola, this was 
much closer to reality and permitted 
the engineering team to get more 
precise measurements. Images 
were taken from multiple positions 
to generate photogrammetry for 
a three-dimensional (3-D) model. 
After Node 3 was installed early in 
the mission, and before the team 
was given the green light to move 
the PMA3, engineers analyzed the 
3-D model to ensure their preflight 
calculations were right. The team also 
had to develop a flight rule that stated 
under what conditions it would be 
“go” for the relocation. 

The team remained cautious. The plan 
was to move the PMA3 between the 
second and third EVA. This meant the 
Cupola had to be moved quickly after 
Node 3 was up and running to open up 
that berthing port for the crew to hook 
up the heater cables on PMA3 during 
the third spacewalk. Even so, the team 
planned to methodically move the 


DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 


71 




Figure 6. A computer-generated analysis showed the ammonia hoses (four white lines) for Node 3 
(upper left) would pass through the PMM near the astronaut’s feet on their way to Node 1 (upper right). 



Figure 7. The spacewalking astronauts from STS-130/ISS-20A and EVA team try to figure out a new 
routing of the ammonia lines and the insulation using a crude mock-up of where the connectors would 
be on the various modules. 


radiator toward its final position on 
the PMA3 and watch with the cameras 
to confirm the clearance. After plenty 
of margin was confirmed, the radiator 
was allowed to rotate freely and be 
“go” for the relocation. 

A new problem surfaced in the fall 
of 2009. With the decision to install 
the new Permanent Multipurpose 
Module (PMM) on the nadir side 
of Node 1, concern arose that the 
billowy insulation over the ammonia 
lines that ran right beside the Node 
1 nadir berthing port might interfere 
with the module during installation. 
Analysis showed that the lines would 
pass through the PMM (Figure 6). 
This is what happens when late 
changes are made to a program that 
has been working on these issues for 
years. The team had to adapt. 

Once the issue was identified, 
the team came up with some 
modifications to the insulation and 
tie-down plan (Figure 7). Newly 
mocked-up ammonia lines were 
built and the crew practiced the 
EVA in the water at the NBL. The 
EVA team became concerned that 
the modifications were not adequate 
enough to ensure clearance with the 
PMA3. With approximately 4 months 
remaining before flight, it was 
getting late to work out some of these 
issues. The team convinced the ISS 
Program officials that it was prudent 
to temporarily shuffle the PMA3 to 
the top of the Node 2 zenith to ensure 
it was not in the way. This meant a 
lot of new, last-minute work, but this 
removed all the residual risk. Training 
for the task of moving the PMA3 
also had to be quickly performed and 
scheduled during Expedition 22—less 
than a month before the mission. 
Fortunately, the ground and crews 
were becoming highly experienced at 
moving PM A3. 


The other half of the ammonia lines 
would be integrated on the third 
EVA. Within this time frame, Boeing 
engineers worked out a new plan for 
the ammonia lines so they would not 
interfere with the PMM. Elbows with 


90-degree turn would be added to the 
lines to angle them away from the 
PMM. Tethers would then be used 
to tie the lines back. This required 
a great deal of analysis because the 
tethers had to be installed prior to the 
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lines being pressurized (they might 
be too stiff to move after), but they 
had to be strong enough not to break 
when the hoses were pressurized. 

At this point, the mission had 
changed a great deal. The plan now 
included the following: 

■ Launch the orbiter with Node 3 
and Cupola 

■ Install Node 3 on the ISS during the 
first spacewalk 

■ Outfit the vestibule of Node 3 
in preparation for activation 
and ingress 

■ During the second spacewalk, install 
two pair of the ammonia lines and 
open one pair to begin cooling and 


allowing for activating half of the 
module. As soon as the systems 
were working, relocate the Cupola 
from the port end of Node 3 to its 
nadir side. Perform 3-D imagery 
analysis to verify radiator clearance. 

■ The next day, move the PMA3 
from its temporary location on top 
(zenith) of Node 2 to the port end 
of Node 3 

■ During the third spacewalk, 
integrate the second ammonia loop, 
open the shutters on the Cupola, 
and take photogrammetry to verify 
the PMA3 will not interfere with 
the Thermal Radiator Rotary Joint 
and that the PMM will not interfere 
with the ammonia lines 


■ Transfer critical items including life 
support systems 

■ Land the orbiter 

The Challenge of the 
Ammonia Lines 

The ammonia lines (see Chapter 11) 
actually turned out to be another 
major challenge for this flight. The 
four lines needed to be about 8 m 
(-25 ft) long—the longest lines on the 
ISS. In addition, the ammonia could 
be at a fairly high pressure (3,400 kPa 
or 500 psi—more than 10 times the 
pressure in a typical car tire) to ensure 
enough fluid was passing fast enough 
to provide an adequate amount of 
heat-removal capability. Once in 
place and pressurized, a rigid line 


What’s in a name? 

In 2009, NASA initiated a novel public outreach 
project: have the public name Node 3. Each module 
of the ISS, however, had been given a friendly name 
by its country of origin (see Introduction); therefore, 
NASA set up a website and asked the public to submit 
names for Node 3. The most popular name would be 
selected. Comedian Stephen Colbert of the Comedy 
Central show The Colbert Report tried to get his 
audience to name Node 3 after him. This campaign 
proved hugely successful and his entry (the “Colbert 
module”) was at the top. By law, NASA could not name 
a module after a private citizen or commercial entity, 
which put the agency in a difficult situation. Colbert 
did a great job of raising awareness of the mission. To 
show appreciation for his efforts, NASA sidestepped 
the issue directly by naming the module Tranquility and 
coming up with a consolation prize: naming the new 
treadmill in Node 3 after Colbert. Initially called by the 
accurate-but-unexciting name of T2, the treadmill was 
rechristened the Combined Operational Load Bearing 
External Resistance Treadmill, or COLBERT (Figure 8). 

It even had an official logo. 



Figure 8. Tom Marsh burn of Expedition 34 exercising 
on the COLBERT in 2012. 
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was not an issue; however, the crew 
members needed to be able to route 
and install the lines while wearing 
their bulky space suits. Therefore, 
NASA chose a flexible design. A line 
of flexible hose was to be attached to 
longer hoses using a braided sleeve 
welded to the joint. This is shown 
in Figures 9 and 10. The hoses were 
scheduled to be completed in May 
2009 (9 months prior to flight). 

A significant setback occurred in 
July 2009 (about 7 months prior 
to flight) when an ammonia hose 
exploded at 50,300 mm Hg (973 psi) 
during pressure testing on the ground, 
causing significant damage to a 
second line nearby. Normally, the 
lines operated at approximately 
20,000 mm Hg (380 psi) with a 
program requirement to be able to 
withstand pressures of 52,000 mm Hg 
(1000 psi). A safety valve should open 
at 23,300 mm Hg (450 psi) completely 
venting the lines in the event of a 
problem, such as a pump running 
at too high of a speed. The hoses 
were tested up to 52,000 mm Hg 
(1000 psi) to ensure that the lines 
would not rupture if the valve itself 
failed. Analysis of the exploded hose 
seemed to indicate that the explosion 
was the result of a manufacturing 
issue and not a design problem, 
thus new lines were produced. The 
number of braids in the welding 
was doubled to improve margin. 

The new hoses began testing in 
November 2009. One of the hoses 
showed a leak. Metallurgical 
analysis revealed that liquid-metal- 
induced embrittlement during the 
welding process led to the failure. 

At this point, the team was less than 
3 months to launch. To add insult to 
injury, a third hose that had passed 
testing was damaged during shipping 



Figure 9. Graphic showing where the four ammonia lines would be routed from the SO truss to 
Node 3. (Note that this figure is meant to show crew access for a given astronaut. Only two astronauts 
would actually perform the spacewalk.) 
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Figure 10. A schematic showing the routing of the ammonia lines (colored). There are four ammonia 
lines—one for the ammonia flowing to and one for the ammonia flowing away from the pump for each 
the A side and B side. 
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Figure 11. Engineers at Marshall Space Flight Center built a test rig that allowed the astronauts to 
roughly lay out the final ammonia lines (wrapped in white insulation, as seen in the photograph) with 
realistic attachment points days before the mission was scheduled to launch. 


from the manufacturer. Of great 
concern was that the damage seemed 
greater than one might expect from 
simply dropping the container. This 
led some to think a critical design 
flaw would prevent the lines from 
meeting their stringent requirements. 

At this point, a “tiger team” was 
formed. A tiger team is a panel of 
experts given the authority to focus 
on a particular issue until a resolution 
is found. At an already busy time, 
numerous reviews and meetings 
were occurring at all hours of the 
day and night, all over the country. 
When the great sleeping beast that is 
NASA awoke, all resources turned to 
this problem. Many members of the 
20A flight control and engineering 
teams were busy supporting the tiger 
team. In addition to understanding 
the issues, the team had to identify 
impacts that any proposed solution 
would present to the mission, and 
then figure out how to modify 
procedures or training. All of this 
had to be done while continuing the 
other ongoing work and training. 

On any mission, the teams sprinted 
to the finish line to have everything 
in place. The extra work provided 
additional pressures and the lead 
flight director had to ensure that 
members of the operations team did 
not burn themselves out before the 
mission. Several parallel paths were 
chosen. First, more of the original 
hoses were being produced. With the 
revelation that the embrittlement was 
caused by welding, a new welding 
process was adopted to hopefully 
prevent this from happening. In 
addition, hoses using a new design 
were being built. Instead of the 
flexible line and sleeve, the middle 
would be a solid tube and a basic 
metal-to-metal, or butt-weld type 


would be used. Multiple versions 
of each type were manufactured to 
allow for further problems. 

The new design really was simply an 
application of previous techniques. 
The method was previously used 
on the ISS, yet the length had never 
before been used either in space or 
on the ground. In fact, since time 
was short, leftover hoses from 
previous evaluations were to be 
used, thereby reducing the amount 
of testing. These hoses were dubbed 
“frankenhoses” because they were 
put together from several pieces. The 
welding process was tried and true. 
In January, the new lines were tested 
to their bursting point of 26,900 mm 
Hg (520 psi). Although the updated 
braided hoses were also ready, ISS 
Program personnel decided to go 
with the frankenhoses. 


The frankenhoses were being 
completed literally as the crew 
went into quarantine. Spacewalkers 
Bob Behnken and Nick Patrick left 
quarantine and flew to Huntsville, 
Alabama, where the testing equipment 
and hoses were located, and where 
the two astronauts would be able to 
handle the items in advance. In fact, 
engineers at Marshall Space Flight 
Center quickly built a test stand that 
roughly represented the attachment 
points (Figure 11). Engineers were 
concerned that the equipment would 
be too stiff, but the astronauts felt 
they could work with the lines. After 
familiarizing themselves with the 
lines, the crew packed the hoses into 
a special EVA bag for shipping to 
Kennedy Space Center where the 
items would be loaded onto Space 
Shuttle Atlantis. 
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Figure 12. Astronaut Robert (Bob) Behnken installs a clamp to hold down the ammonia lines during a 
training run in the NBL 


Training 

Training began in earnest 
approximately 6 months prior to 
the planned mission launch. Several 
types of training were involved. 

Since the teams were composed of 
experienced flight controllers and 
flight directors, the training at this 
point was called “flight specific” in 
that it dealt with the actual mission 
instead of any generic skills. On the 
Space Shuttle side, the team—i.e., 
the flight control team and the 
astronauts—performed a number 
of simulations, primarily practicing 
launching, landing, and aborts. 

The ISS teams also trained. Flight 
controllers on the ISS side of the 
house simulated the spacewalks, 
as well as the berthing, moving, 
and activation of modules during 
approximately a dozen simulations 
(sims). A key series of sims for the 
ISS team was the powering down 
of half the systems, integrating 
the loop A or B ammonia lines, 
and activating Node 3 and Cupola 
modules. Owing to the complexity 
of this task, the EVA steps were 
role-played during these sims instead 
of having the actual astronauts 
perform the steps in the NBL at the 
same time. Several joints sims were 
conducted between the two program 
teams, especially for rendezvous and 
docking. The station training lead 
and the shuttle simulation supervisor 
were key members of the operations 
team. Not only did they ensure that 
the crew and flight control team were 
trained and ready for the mission, 
they also poked at the timeline or 
flight rules to look for any issues 
the team had not considered. For 
example, looking into the timeline 
or flight rules might reveal the 
team had not allowed enough time 


for an activity, or a flight rule that 
was perfect for a nominal situation 
completely fell apart if something 
went wrong. The trainers would 
throw numerous malfunctions at 
the flight control team. This helped 
that team gain the confidence 
needed to deal with real problems 
in space while remaining composed. 
Although the specific simulated 
failures may not occur during the 
mission, the team knew how to work 
the problems in a cool and integrated 
fashion. The flight directors worked 
closely with the station training lead 
and shuttle simulation supervisor 
to ensure the core elements of the 


mission would be fully trained; 
however, the specifics were left to 
the training team. 

As the months went on, the flight 
directors ensured the controllers 
worked seamlessly as a team and 
that the plans were ready for the 
real mission. Since everyone was 
so nervous about the ammonia lines, 
the sneaky training team even 
threw in a simulated ammonia leak 
during one of the training runs. 

The team worked through it in the 
simulation, but everyone realized 
the situation had not been thought 
through completely. Therefore, the 
team cleaned up the procedures and 
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Figure 13. The billowy white insulation surrounding the ammonia lines at the NBL mock-up. This insulation drove the decision earlier on how to move PMA3 
so as to not interfere with the PMM. Note that when the bag that held the ammonia lines was opened in the pool, the lines would shoot out toward the bottom 
like a crazed jack-in-the-box due to the orientation of the mock-ups in the water. Due to the problems with ammonia lines, as described, the final flight units 
were not ready for the mission until a few days before the mission. The spacewalking crew members wanted to handle the final items so they would have an 
idea as to what to expect on orbit. Therefore, the final days before the launch, they flew to Huntsville, Alabama, where the lines were being manufactured. 

Not only did they handle the ammonia jumpers, they packed the specially designed bag. The packed hoses were then rushed to the launch pad and stored in 
the orbiter. The crew members flew back to their quarantine facility at Kennedy Space Center. 


trained everyone with additional 
review and simulations. 

A key part of the training was 
having the crew practice the 
spacewalks. The crew and EVA 
team, as well as the lead station flight 
director, conducted many dives in 
the NBL to practice the timelines. 
Although EVAs are always tricky, 
the ammonia lines were, once again, 
the biggest challenge (Figure 12). 

The crew needed to extensively 


practice the installation in the 
NBL because the ammonia lines 
were long, stiff, and covered by 
bulky insulation (Figure 13). The 
team also tried to figure out how 
best to carry such long lines out to 
the worksite, and then unpack and 
install them. Imagine carrying four 
stiff 8-m (25-ft) long rubber garden 
hoses from the garage. Then 
imagine doing it in weightlessness. 
A new bag was designed to hold the 
hoses. The crew practiced, in the 


water, how best to position and 
open the bag, and remove and install 
the lines without getting a big tangled 
hydra on orbit. Due to the presence 
of gravity in the NBL, the hoses 
tended to come springing out of the 
bag like a crazed jack-in-the-box— 
or even something more disturbing, 
like in a scene from the movie 
Alien —once the crew opened the 
bag on the bottom of the mock-up. 
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The Making of a Crew Member 

Robert Behnken, Lead Spacewalker 
STS-130/ISS-20A 

During the making of a mission into space, whether it is 
a short-duration, long-duration, first, or last flight, crew 
members need to strike a balance between taking enough 
ownership that they are ready for all the tasks they will 
face, but not taking so much ownership that they become 
too disappointed should the mission change before their 
eyes. NASA has plans for lots of exciting missions that 
have not been done, and none of us can do them all! For 
STS-130/ISS-20A and ISS Increment 22, the missions 
covered a wide range of exciting tasks right up until they 
were executed. 

As a part of the many mission permutations, after the 
Columbia accident in 2003 and prior to the Space Shuttle 
Return to Flight in 2005, NASA built plans to keep the 
station populated in the face of an unpredictable shuttle 
launch schedule. I was part of a group of astronauts 
assigned to prepare for the ISS missions without a 
firm mission date. Our supervisor at that time was 
fellow astronaut and ISS veteran Peggy Whitson. I still 
remember her words to us as we began training: “The 
good news is you are all assigned to missions to the ISS. 
The bad news is I can’t tell you when they will be or how 
you will get there!” Officially, we were known as the “ISS 
Training Pool”... or “b 6acceiiHe” (literally “in the pool”) to 
our cosmonaut friends. (They found this quite humorous. 
To them, it implied we were on vacation in a “swimming 
pool” while they were hard at work!) And so we started, 
knowing we were headed to space but not knowing 
whether we were preparing for shuttle or Soyuz flights. 
When foam insulation again separated from the external 
tank during the STS-114/ISS-LF-1 (Return to Flight 
mission) launch, the launch manifest continued to evolve 
and we did our best to prepare for all options. 

Over the course of the next year and a half, those of 
us in the ISS Training Pool became certified operators 
and specialists on various ISS systems, continued our 



Figure 14. Bob Behnken and Nick Patrick installing ammonia lines and 
associated insulating blanket during the second STS-130 spacewalk. 
Limited consumables dictated that the installation plan proceed precisely 
according to schedule to ensure enough clean-up time after the 
predicted ammonia leakage time frame. 

study of the Russian language, and traveled to Star City 
to be trained on the Russian portion of the ISS. From 
time to time we would hear snippets from the training 
or the planning flight controllers on what NASA had in 
store for us, and we would receive congratulations from 
cosmonauts that had seen our names on future manifests 
(sometimes as their crewmates). Through it all, we tried 
to not get our hearts set on any particular solution and 
to prepare the best we could for spaceflights...however 
and whenever they came. Largely outside our day-to-day 
life as assigned astronauts, NASA continued to make 
progress on the challenges with the shuttle external tank, 
and the flight manifest began to stabilize. For those of us 
who were prepping in the ISS Training Pool for uncertain 
missions, things became a lot clearer. For me, it meant 
leaving the “swimming pool” and preparing for the longest 
shuttle-docked mission to the ISS and the first five- 
spacewalk mission to the ISS, and leaving behind a Soyuz 
flight to the space station in the Increment 22 time frame. 

The shuttle manifest continued to remain relatively stable 
for the next year. In March 2008, my shuttle crew and I 
completed STS-123/ISS-1J/A, finished our post-flight 
activities, and began technical jobs back within the 
astronaut office. I was assigned to future program support 
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(vehicle development for exploration missions after space 
shuttle retirement), and was surprised late that year to 
learn that I was headed toward another shuttle mission on 
STS-130. After looking closely at the manifest, it became 
clear that this mission would likely be during Increment 
22 in the time frame I would have been on board the ISS, 
had my path continued on the Soyuz route 2 years earlier. 

As the rest of the chapter outlines, the assembly mission 
STS-130 and its associated hardware took a twisted 
route to its final incarnation, just like I did as a crew 
member. Over the years, the cupola was an on-again/ 
off-again part of the ISS. Certainly no mission would be 
dedicated to delivering it, and much of the space station’s 
primary function could be performed without it. But, 
in the end, the value of having an observation port for 
visiting vehicles carried it to orbit. Node 3 was relocated 
even before it was ever installed and, as described in 
the chapter, the number of little things that had to come 
together to make that possible is just amazing. The 
fact that they all came together on schedule to allow 
for module activation during the STS-130 mission was 
an added plus for our shuttle crew (although it wasn’t 
something we could have our hearts set on). At one 
point during the ammonia flex line development and 
test sequence, when the schedule seemed particularly 
challenging, the idea of delaying install and activation 
to a future shuttle crew was considered. Having trained 
dozens of hours for these tasks in NASA’s Neutral 
Buoyancy Laboratory (NBL) and assisted with the 
development of the hardware itself, both myself and my 
spacewalking partner Nick Patrick knew that this task 
would not be easy, even for us, and that it would be 
extremely challenging if someone else picked it up on 
short notice and tried to squeeze it into their already- 
packed mission timeline. 

Module activations for new parts of the ISS delivered 
by space shuttle generally involved the same basic 
steps. One: move module from payload bay to ISS. Two: 
connect power and cooling. Three: gracefully incorporate 
the new hardware into the rest of the ISS system. For 
Node 3, Step 2 was above average in difficulty, and it was 


the one being considered for transfer to a future flight 
if the ammonia flex line hardware was not available at 
launch time. The install required four stainless steel flex 
lines to be installed and then wrapped in a large insulating 
blanket. Normally it is pretty challenging if a spacewalk 
has to install something that is bigger than a crew 
member. In our case, this spacewalk had five big items, 
and keeping them under control simultaneously was even 
more challenging. After several months of development, 
Nick and I and the rest of our team had a pretty slick 
process for getting it all done and even looking graceful 
while we did it. Gone were the days of all the hardware 
falling to the floor of the NBL as the initial scene from 
our spacewalking show. As the lead spacewalker for 
STS-130, I remember being asked about the spacewalk 
content being moved to the next shuttle crew, and how 
some felt our crew should advocate to the ISS Program 
that we should keep the content. My input was that we 
should let the other crew try the install and see how they 
felt about taking this content on. As with the ISS training 
that I started years before for an uncertain mission, I felt 
we would execute whatever mission they eventually put 
in front of us whether or not it included ammonia flex lines 
and insulation. In the end, the follow-on crew members 
that attempted our “EVA 2” were the strongest advocates 
for STS-130 to keep the content. For them, 6 to 7 hours 
of wrestling ammonia lines and insulating blankets made 
it clear that this EVA had more than its share of blood, 
sweat, and tears to extract from the installation crew and, 
in their minds, they were happy to have it be ours! 

During my time on orbit during STS-130, I had a great 
appreciation for all that had gone into the development 
of the mission (Figure 14). My discussion with the 
ISS commander regarding how we could task his crew 
to assist with our spacewalking preparations really drove 
home all the alternatives for which we had prepared. 
Having trained for that crew years before, I really 
understood what they could do for us and what we 
could do for them. In the end, both the Increment 22 
and STS-130 crews were really proud to be a part of 
the mission. 
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Fly 

After an unusually lengthy and busy 
interval of preparation, it was finally 
time to fly. The road was long, but 
everyone was ready by February. The 
training was done. The multitude of 
programmatic reviews were complete 
at NASA, culminating in the Flight 
Readiness Review. The consoles were 
stocked with office supplies and extra 
food. The mission was scheduled to 


lift off on February 7, 2010, but was 
delayed due to poor weather. After a 
frenetic rush toward the mission for 
many years, there was an eerie calm— 
not unlike that slow creep up and 
over the first hill by a roller coaster 
before it takes a deep plunge. On 
February 8, Space Shuttle Endeavour 
launched perfectly (Figure 15). The 
final mission timeline and plan for the 
spacewalks are shown in Figures 16 
and 17, respectively. 


The Space Shuttle flight control team 
and its flight director monitored 
all the systems of the orbiter while 
preparing for rendezvous and 
docking. Things were a little quieter 
in the space station flight control 
room, since their part of the mission 
did not begin until final rendezvous. 
This gave the team time to make 
the last updates of procedures and 
provided an opportunity for the flight 
director to, once again, write down a 



Figure 15. Launch of Space Shuttle Endeavour on February 8,2010 (left). View of Endeavour’s cargo bay from the ISS showing Node 3 with Cupola attached 
to the end. Due to the weight of the module, the rest of the cargo bay was empty. 
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Figure 16. The final 
overview timeline used to 
execute the 20A mission. 
Shuttle missions went 
by Flight Days with the 
first beginning at the 
moment of launch, even 
if the astronauts had 
been awake fora while. 
Twenty-four hours later, 
Flight Day 2 would begin, 
and so on. This graphic 
illustrates the major 
events that the Shuttle 
and ISS crews performed. 
Other key activities—just 
as “N3 ground act” 
(approximately 04:00 
GMT on Flight Day 07), 
which was performed 
by the ground—appear 
above the Flight Day 
events. Note that the 
flight control team and 
the astronauts followed 
a much more detailed 
timeline as shown in 
Chapter 1, but this 
provides a quick view of 
the key events and how 
they relate to each other. 


DAY IN THE LIFE: THE MAKING OF A MISSION CHAPTER 4 


81 


























































































































































































































Egram' 

Setup 

Node 3 Unfcehh Prep 


OTP ftetncvaf 

Node 3 Anores Cable Insist 

OH 

Ahead 

Cleanup 1 

hgr«4 

6grfra 
Setup 

HMleSUnCwn Prep 

NHs&agCtJS 


tiodi3 LTACWtlitfd 


Cleans 

Iftgrw 


< § 


0400 



NedelMKfeCEU 

TfLnmoflC&rtf 


Op 

tnstafl 


Sgwsf 

Seb^s 

Loop A Jumper irotal 

WiMJksM 

NHj Loop B Jumper Instal 

Nrtj MLUnsSal 

Egress' 

Setup 

MHj Loop A Jumper mslal 

HHj HLMrretal 

NH) Loop B Jumper Instal 

NKjMLJ instal 


Noth 3 <XH install 


NoMUNPV lr Sai 


Egress' 

Setup 

Open Loop B QDs 

ttritJLTACriif 

Drttmtutf 

Cup&ULI R*rKrv*l 

nodes 

QIWF 

Inst# 

Nod* JCWfrri# 

6*1 Ahead 

QfarnV 

Ingress 

Egress' 

Setup 

PortACBM Shied taslal 

Cupola MLI Removal 

Cupola Launch Lck* fieeaw 

gel Ahead 

Cleanup*' 

Ingress 


1 

S 3 
3 I 


Figure 17. The final EVA timelines. EVA 1 consisted of preparing Node 3 for berthing. First the LTA power cable that powered the heaters was disconnected 
and bolts holding the module in the cargo bay were released. While the robotic arm was moving Node 3 from the orbiter cargo bay to its berthing spot, 
the crew performed other tasks such as positioning the bag that holds the ammonia hoses and removing the Orbital Replacement Unit Tool Platform. Once 
berthed, the spacewalking astronauts reconnected the heater cable as well as an avionics computer cable that would allow the computers to talk to the rest 
of the ISS systems. On EVA 2, the ammonia line of the ‘A’’ side of the cooling system was installed, and MU (see Figure 14) was installed. This was repeated 
on the “B” side. The trunions, which helped hold the module securely in the cargo bay, were then covered to prevent heat from leaking away from the module. 
During EVA 3, the Loop “B” cooling was fully integrated into the ISS system (Loops B QDs) followed by removal of the MU that protected the Cupola and the 
releasing of locks that held the shutters in place during launch. The LTA heater cable, which was no longer needed since Node 3 systems were now fully 
functional, was removed. Other small tasks were performed on all three EVAs. The Get Ahead section on the last spacewalk consisted of a list of small tasks 
that were not required for STS-130/ISS-20A but that had to be performed at some point; time permitting, the EVA officer picked tasks from a list of various 
options for the crew to perform. 


list of open issues—or worse, think 
about the things that they might have 
forgotten. However, issues constantly 
surfaced. Big and small trades were 
made at every turn. The Oxygen 
Generator Assembly failed a few days 
prior to the launch of Endeavour. 

The engineers pushed to have it fixed 
before the rack was relocated into 
Node 3. That way, if it couldn’t be 
reactivated, it was definitely related 
to the move and not the original, 
yet-to-be-diagnosed failure. The 
ISS team revised their timeline 
to squeeze in some repair work. 

A cooling valve on the Columbus 
module was not working properly, 
thus the team had to evaluate how 
it would impact the shutting down 
of the ammonia loops. Several 


meetings were held where the flight 
controllers concluded that only minor 
impacts could be accommodated in 
the procedures. A recent longeron 
shadowing event (see Chapter 9) had 
ISS Program management concerned 
that damage may have been done 
to the mast. They wanted high- 
resolution photographs to inspect for 
possible damage. The windows on 
the orbiter’s aft flight deck offered 
the best viewing location. However, 
the ultraviolet window screen would 
have to be removed to produce the 
sharpest photographs—an option 
that violated safety rules. Then the 
team got word that the president of 
the United States, Barack Obama, 
wanted to talk to the crew during the 
mission. The president’s schedule 


would drive the linkup, which 
meant the astronauts would not be 
speaking with the president during 
the prime part of their workday since 
it took place in the middle of the 
night, Eastern Standard Time. The 
flight directors began adjusting the 
schedule to make it work. Besides the 
public relations aspect, it would be a 
nice treat to give a hardworking crew 
during the mission. 

The flight control team was used to 
working around these types of issues. 
By all standards, the mission was 
going smoothly. The training and 
hard work of numerous people over 
the years was paying off. The first 
significant issues with the intricate 
ballet of module movements came 
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Figure 18. The 7-m (23-ft) long duct extended through Node 3 and into the Cupola to ensure proper airflow. Pictured are NASA astronauts Jeffrey Williams 
(center), Expedition 22 commander; Terry Virts (left), STS-130 pilot; and Nicholas Patrick, STS-130 mission specialist. 


when the crew ingressed the Cupola 
on Day 6 of the mission to ready it 
for the relocation. To ensure adequate 
airflow with the 7 m (23 ft) duct 
(Figure 18), the crew used a device 
to measure the airflow and found it to 
be much less than expected. Per flight 
rules, fewer crew members were 
permitted in the area. Next, the crew 
went in and installed a protective 
cover over the Cupola to thermally 
shield it during the relocation. 
Unfortunately, the cover could not be 
installed on the ground and launched 
into position because the vibrations 
caused by the launch were greater 
than the structure of the Cupola could 
withstand if the cover was in place. 
When crew members installed the 
cover, they noted that the clearance 


between the cover and some brackets 
was too small—a thin metal ruler 
barely fit between the bracket and the 
insulation. If the clearances were even 
tighter on the nadir port, the Cupola 
could not be mated. 

The contingency teams, including 
Team 4 (see Chapter 20), roared to 
life to analyze the problem. There 
was only a small window of time 
before things such as the PMA3 
relocation dropped off the mission if 
the ballet got backed up. The teams 
considered different options. Could 
they do the move without the cover? 
What was the expected clearance on 
the nadir port since the module had 
never actually been physically mated 
together? Would the motors have 


enough force to bend the brackets 
without damaging the structure if 
there was interference? The root of 
the problem quickly became apparent: 
to save file size, the computer models 
did not include bolts since thousands 
of bolts added megabytes to each 
drawing. What seemed like a small 
issue became a significant wrinkle. 

The mission was not placed on 
hold while that problem was being 
worked. While preparing Patrick’s 
space suit for the second EVA, 
the team discovered that the fan 
speed of the water pump was far 
less than expected. If it failed 
during the spacewalk, it could 
jeopardize his life and cause the 
flight control team to abort the EVA. 
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Unfortunately, repairing the suit 
required two crew members for 
2.5 hours, which translated into the 
need for a significant amount of 
schedule replanning. 

It was common for the simulation 
team to be maligned for coming up 
with diabolical scenarios. Yet, their 
efforts paid off when, as if on cue, 
Patrick got a small spray of ammonia 
during the second EVA. Everyone 
knew what to do and how long it 
would take. The flight control team 
worked through the procedures, 
and no ammonia was detected in 
the atmosphere. Vindicated, the 
training lead knew his training had 
been successful. 

After a number of meetings around 
the clock, the teams determined 
that there would be barely enough 
clearance for the Cupola to fit on 
Node 3 nadir. If enough clearance 
did not exist, it was likely some of 
the brackets would bend but nothing 
would break. This, however, was 
considered unlikely. The teams 
pressed ahead toward the relocation. 
After the second spacewalk, the 
Node 3 module was activated for 
the first time using half of the power 
and cooling systems (Figure 19). 
After the activation, one of the key 
Multiplexer/DeMultiplexers (MDMs) 
controlling Node 3 nadir Common 
Berthing Mechanism (CBM), where 
the cupola would be mated, failed 
into the diagnostic safe mode (see 
Chapter 5). While the flight control 
team tried to quickly interpret the 
cause, the flight director ensured 
the team didn’t get too far behind 
on the timeline and that the most 
critical objectives could still be 
accomplished. After a power cycle, 
the MDM was operating again and 
preparations for the mating could 


continue. However, this was not the 
only challenge keeping the Onboard 
Data and Information Network 
officers in particular, and the team 
in general, occupied. The computer 
system in the Columbus module had 
experienced an unknown failure and 
was not working. 

Flight Day 8 arrived, and it was time 
to relocate the Cupola. Problems 
in the CBM—basically, the system 
of bolts used to fasten modules 
together—rarely occurred on orbit, 
so it came as a bit of a surprise 
when in Mission Control OSO saw 
an indication that one of the bolts 
had jammed while trying to detach 
the Cupola. After quick discussions 
with the engineering team, OSO and 
the flight director decided to force 
the bolt to push harder. The bolt 
released, but a second one jammed. 
And then a third. This scenario 
was completely unexpected. The 
ground team had to stop to assess 
the situation, and to avoid damage 
to the hardware. However, it was 
like having an automobile tire half 


off, and not a good place to be in 
the long term. In real time, the team 
deduced that gravity caused the 
bolts to tighten unevenly during 
installation at Kennedy Space Center, 
unlike previous modules that were 
bolted together exclusively on orbit. 
Therefore, the forces on the bolt 
would be uneven as the Cupola was 
being de-mated (this is analogous to 
removing the adjacent lug nuts, rather 
than opposing nuts, while changing 
a tire). As in a simulation, the flight 
control methodically nudged and 
tweaked the bolts. Soon, the Cupola 
was free and moving to the Node 
(Figure 20). The clearances were fine, 
the MDM continued to operate, and 
the CBM bolts worked smoothly as 
the Cupola was firmly mated to the 
bottom of Node 3. 

Since things were now running 
smoothly, the Space Shuttle Program 
and ISS Program teams agreed to 
use the extra mission day for the 
rack transfers. On the 8th day of the 
mission, the crew was like an army of 
ants, removing bolts that would hold 
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Figure 20. Cupola being maneuvered into position on the nadir side of Node 3 (left), and astronaut Patrick, during the third spacewalk, after removing the 
insulation that protected the module from launch until its heating system was operational (right). 


things in place during the tremendous 
vibrations during launch, removing 
items stowed in Node 3, moving 
the life support racks and exercise 
equipment into place, and trying to 
secure all the elements. It was slow 


work. Each rack was shut down and 
carefully moved to the new location 
(Figure 21). The flight control team 
then powered the system back up. 
Every rack experienced some small 
hiccup during the relocation—a 


cable not connected properly, the 
software not exactly as it had been 
tested on the ground, air bubbles in 
the plumbing—and the team had to 
work through each issue. As with 
the OSO position, the ECLSS team 
had so much going on that two front 
room flight controllers had to work 
the various rack activities. Each 
system was so busy with its own 
activities. The flight director had to 
ensure everyone worked as a team 
in completing the critical activities 
on the timeline while deferring, 
and replanning, those that needed 
to be moved, and while working 
with the engineering support team 
and the Europeans on the various 
other working issues. The role of the 
flight director is not unlike that of a 
Chinese acrobat who balances several 
spinning plates on poles. Every shift 
presents a new wrinkle, such as when 
the lead EVA officer came down with 
food poisoning and had to go home 
for a while, creating yet one more 
issue for the flight director to balance 
and work through. 


Figure 21. Astronauts maneuver one of the many racks relocated to Node 3 module during the 
mission. As two crew members pushed a rack into a place, a third crew member helped guide it. All the 
power, data, and cooling cables would then be mated. 
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Figure 22. President Barack Obama talks to the astronauts (seen in a video linkup in the top right of the picture) while students look on. Although the president 
could see the astronauts, no video was transmitted in other direction; therefore, the astronauts could not see what was happening at the White House. 


Due to the length of the mission and 
the intense work being performed 
to that point, part of the 9th day 
of the flight was crew time off. At 
this time, the crew members get to 
rest and enjoy some views from the 
Cupola. But first, as soon as the crew 
members awoke, they had a linkup 
with the president (Figure 22). After 
a brief period of rest, the crew began 
preparing for the final spacewalk, 
which would take place the next day. 

Analysis of imagery taken during 
the first spacewalk revealed that 


the clearance with the radiator and 
the PMA3 should be sufficient. 
Therefore, PMA3 was relocated 
to the end of Node 3. As an extra 
precaution, the radiator was slowly 
rotated as the Thermal Operations 
and Resources flight control team 
watched to ensure there would be 
no contact. The team confirmed that 
everything was good. 

Without incident, EVA 3 integrated 
the B side of the ammonia lines, 
this time with no ammonia leak. 
Insulation was removed from the 


Cupola shutters during the spacewalk, 
and the windows were opened for 
the first time. Even in a business 
routinely filled with amazing 
visuals—a Space Shuttle launch, the 
ISS floating above the Earth, a person 
in a space suit floating among the 
heavens—the view from the Cupola 
was stunning (Figure 23). 

As quickly as the storm began, 
the mission started to wind down. 
Although not every task was 
complete, it was time for the 
crew of Endeavour to undock and 
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Figure 23. View of Earth from the newly installed Cupola. 



Figure 24. The underside of the ISS, as photographed by astronauts aboard the undocking shuttle, 
showing the newly installed Node 3 and the Cupola. 


return home. Far more had been 
accomplished than had been planned 
for even a year prior to the mission. 
Endeavour undocked on February 20 
and flew around the station. Photos 
were taken of the new installed 
module (Figure 24). The ISS crew 
took a much-needed break and then 
completed the outfitting of Node 3 
and the Cupola over the next few 
weeks. On February 21, 2010, 
Endeavour made a flawless nighttime 
landing at Kennedy Space Center. 


Epilogue 

The final task of any mission is 
to conduct a “Lessons Learned” 
review. Even though more than 100 
shuttle flights had flown and dozens 
of ISS assembly missions had been 
conducted, NASA still learned from 
its mistakes. Every organization 
examined every step, from planning 
through training and into execution. 
The flight control team generated 
recommendations in each area 
and the flight director conducted a 
panel to determine which of those 
should be elevated and instituted in 
future missions. For example, it was 
agreed that all future spacewalks 
that entailed working with the 
ammonia lines would conduct some 
sort of contamination scenario in a 
simulation. But it was not all about 
criticism. Things that worked well 
were also highlighted so that other 
teams in the future can carrying 
those practices forward to help 
ensure everything goes as smoothly, 
or better. This is a key part of the 
Flight Operations Directorate culture, 
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Figure 25. Lead OSO Kyle Brewer (left) and Lead ECLSS Officer John Garr (right) hang the 20A mission and module patches in the control room following 
the successful mission in 2010. 


and this work ethic is reflected 
in the competence and teamwork 
statements in the Foundations 
(See Introduction). 

The operations team conducts two 
major ceremonies after each mission. 
The first—and, to many, more 
meaningful—is the hanging of the 
plaque. Since the days of project 
Mercury, the flight director would 
pick the person, persons, or team that 
did the most outstanding job during 
the mission and let the honoree(s) 
hang the mission plaque (Figure 25) 
that had been displayed at the flight 
director’s console during the flight. 
Actually, two plaques—crew mission 
patch and ISS mission patch—were 
awarded for a given Space Shuttle 
assembly mission. 


The second ceremony was held 
at Space Center Houston—the 
Johnson Space Center visitor 
center. Here, the crew showed 
video and narrated highlights 
from the mission. Various 
individual and team recognitions 
were awarded at this ceremony. 
However, a few minutes of 
recognition and thanks by the 
managers of the Space Shuttle and 
ISS Programs and the lead flight 
directors never fully reflected the 
immense amount of effort that 
went into the mission. 


Although the ceremony marked the 
official end of one mission, the teams 
(Figure 26) were already poised to 
start the process all over again. 

Later that year, when NASA was 
trying to figure out what to do 
after President Obama redirected 
the Constellation Program, some 
officials at the space agency wrote 
a press release stating that Node 3 
could be detached from the space 
station and incorporated as part of 
a new vehicle that would go to an 
asteroid. Flight Director Robert 
Dempsey shook his head, laughed, 
and uttered the words that the whole 
team was thinking: “If they only 
knew how hard that would be.” 
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Figure 26. The seven flight 
directors and their teams that 
supported STS-130/ISS-20A. 

The ISS teams are pictured 
on the left (from top to bottom): 
the Galileo team on the prime 
shift (orbit 1), the Tungsten team 
(orbit 2), and the planning shift 
team led by Saturn Flight (orbit 3). 
The Space Shuttle teams are shown 
on the right (from top to bottom): 
Defiant (orbit 1), Viper (orbit 2), and 
Venture Flight (orbit 3). Amethyst 
Flight, with the launch or ascent 
team, is located bottom center. 
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Chapter 5 Systems: 

Command and 
Data Handling— 
The Brains 
of the International 
Space Station 




Astronaut Susan Helms does a little ‘‘light reading” on the International Space Station. 


Brains . That is essentially what 
the Command and Data Handling 
(C&DH) system is for a spacecraft: 

Part of what is termed avionics , the 
C&DH system is responsible for 
the control of the primary systems 
of a spacecraft. 

Early spacecraft used electrical and 
mechanical switches to operate 
the vehicle. From the beginning 
of the Space Age, up through the 
Space Shuttle era, the astronaut 
was a primary component of the 
C&DH system—adjusting dials 
as needed, throwing a switch to 
configure a system, and responding 


when a component malfunctioned. 
Over time, computers played an 
ever-more-crucial role. Computers 
performed critical calculations that 
required accuracy and speed such 
as calculating the trajectory of a 
spacecraft as it descended to the lunar 
surface. The lunar module navigation 
computer possessed less than 
40 kilobytes of memory and ran with 
a processing speed of 2.048 megahertz 
(MHz). By comparison, a basic Apple 
iPhone in 2014 contained 200 times 
more memory, ran 1,000 times faster, 
and produced pictures typically 
2 megabytes (MB) in size. For the 
International Space Station (ISS), the 


crew would no longer be a primary 
component of the C&DH system. 
Computers took over virtually every 
aspect of the vehicle’s operations. 
Whereas the crew on the Space 
Shuttle interacted with the flight 
systems primarily through the use of 
switches or dials, nearly all aspects 
of the spacecraft operating system 
on the ISS are operated by computer 
interface and are therefore readily 
operable by the ground control team 
(i.e., the ground). This frees the crew 
to focus on research. 

The C&DH system directs the 
operations of other systems via 
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“command” while moving, or 
handling, information around the 
vehicle. In essence, C&DH would 
be familiar to the average person as 
the computer network. A command 
is a set of instructions telling a 
computer to perform an action. 

For example, the print command is 
common among computer users on 
Earth. Spacecraft employ a variety 
of C&DH systems, depending on the 
functional need of the vehicle and its 
architecture. Complicating matters 
further, the ISS C&DH system—the 
largest such system ever operated 
in space—is in fact an amalgam of 
computer networks developed in 
multiple countries. Each segment, 
Russian and United States On- 
orbit Segment (USOS), has its own 
architecture bridged by Node 1, 
aptly named Unity. The USOS is 
split into the American, European, 
and Japanese modules, each with 
its own computer network. As part 
of its function, the C&DH system 
will detect failures—whether they 
involve a piece of hardware such 
as a valve or are in the computer 
system itself—and alert the crew 
and ground via alarm. Astronauts 
use a laptop called the Portable 
Computer System (PCS) to interface 
with the C&DH system. Using this 
laptop, they can run procedures 
that operate the vast majority of 
ISS systems, although the ground 
tries to perform most procedures to 
free up the crew for research. Due 
to its important role in operating 
the spacecraft, the C&DH system 
(including the PCS) is classified as 
critical and therefore requires robust 
hardware or redundant components 
to ensure proper operation as well 
as exhaustive software testing. 
Astronauts also have a separate 


laptop called the Station Support 
Computer (SSC) upon which they 
can view the timeline and read 
procedures. SSCs are not linked 
to the C&DH system; because the 
SSCs provide only a support role 
(i.e., perform no critical function that 
would impact operating the ISS if an 
SSC failed), they are not considered 
critical. The SSC laptops connect to 
a Local Area Network (LAN) that 
would be familiar to anyone using 
laptops on a network. Payloads are 
generally controlled from the SSC. 
Through the SSC, astronauts can read 
email, access the internet, and use an 
Internet Protocol (IP) phone. 

Initially, the Onboard Data Interfaces 
and Network (ODIN) officer 
operated the ISS C&DH system. 

Later, the ODIN function merged 
with the Communications and 
Tracking Officer function to form the 
Communications Radio Frequency 
Onboard Network Utilization 
Specialist (CRONUS) position. ODIN 
was supported in the back room by a 
resource avionics engineer. Although 
the SSCs are computers, they are not 
part of the C&DH system. Rather, 
the SSCs are handled by the PLug- 
in-plan and UTilization Officer flight 
control position (see Introduction)— 
also known as PLUTO—and are not 
discussed here. 


Overview 

The USOS C&DH system consists 
primarily of 46 nearly identical 
computers networked into a top- 
down tiered structure, as illustrated 
in Figure 1. At the top of the pyramid 
is the Command and Control System 
(CCS), a triply redundant set of 
computers located in the Laboratory 


Module that act as the brains of the 
USOS. Only one computer controls 
the system at a given time; if that 
computer fails, the second or third 
will take over operations. Due to 
the critical role of the CCS, three 
computers are required to ensure 
that multiple failures would not 
disrupt the control of the vehicle. 

The ground directly interfaces with 
the CCS via uplinked commands 
through the Communication and 
Tracking (C&T) system (see 
Chapter 13), whereas the crew can 
interact using a PCS. The CCS 
interfaces directly with the top-level 
computer on the Russian Segment 
known as the Service Module 
Central Computer (SMCC), as well 
as the computers in the European 
and Japanese modules. 

The local tier (Tier 2) is located 
below the control tier. Computers 
at the local level control most 
spacecraft functions as well as the 
partner modules. Computers inside 
the ISS control such functions as the 
regenerative life support systems, 
ventilation, and temperature control 
while those on the exterior control 
heat rejection and the giant solar 
arrays. Another Tier 2 function is that 
of Guidance, Navigation, and Control 
(GNC), which drives the Control 
Moment Gyros while calculating the 
trajectory of the ISS using Global 
Positioning Satellite (GPS) sensors. 
Although still important, the Tier 2 
computers are not as critical as the 
CCS and, therefore, have only a 
single backup in case of failure. 

At the bottom of the triangle is the 
user tier, indicated as Tier 3. This 
tier is responsible for control of all 
sensors and end effectors that are 
wired to computer cards within the 
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CDC Tier Interfaces 




Figure 1 . Representation of the USOS C&DH system illustrating the tiered nature of the computer system. Tier 1 (the top tier) is the control tier, directing 
(red lines) all the lower-level computers. Data, or telemetry (purple lines), rise from the lower tiers back to the top where it is radioed to the ground control 
team or sent to the crew’s portable computer system. Tier 2 (the local tier) is where major functions such as guidance or thermal control are performed. All 
the sensors, fans, pumps, valves, etc. are controlled at Tier 3 (the user tier). 


Tier 3 Multiplexer/DeMultiplexers 
(MDMs). Sensors include devices 
that can measure the carbon dioxide 
or oxygen level of the crew’s 
atmosphere, the pressure inside a 
cooling loop, the speed of a fan, or 
the temperature of something. These 
devices are wired to an Input/Output 
(I/O) card in the computer. The value 
read by the sensor is transmitted to 
the card, which the computer will 
output to the Tier 2 MDM above it, 
where it is passed to the Command & 
Control (C&C) MDM for downlink 
to the ground. End effectors are 
items with moving parts, such as 
a switch or a motor, to effect a 
change. Some end effectors actually 


fire pyrotechnics (i.e., explosives) 
such as those used to release straps 
holding collapsed radiators in place 
for launch. Solenoid Driver Output 
Cards provide the interface between 
the MDM and the end effectors. 
When power is applied to the card, 
a solenoid will physically move to 
push or pull an item such as a valve 
into position. The ISS has thousands 
of these sensors and effectors, and 
almost all are replaceable on orbit 
if a repair is required. The Remote 
Power Control Modules (RPCMs), 
which are effectively circuit breakers 
that can be opened or closed via 
computer, are the most common type 
of effectors. 


Robustness at the user tier level 
(Tier 3) is achieved through 
redundancy of the systems. For 
example, a critical system may have 
two independent power feeds so that 
no interruption of electricity occurs 
if one power feed fails. Another 
example is where two separate 
heaters exist when only one would 
ever be needed. Tier 3 computers do 
not have backup MDMs since the 
systems themselves have layers of 
redundancy to protect against critical 
failures; of course, spare boxes are 
available on orbit to replace failed 
boxes. A summary of all the tier 
computers is provided in Table 1. 
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Table 1 . A Summary of the Computers and their Functions on the ISS 


Multiplexer/ 

DeMultiplexer 

Configuration 

Major Software Functions 

TIER 1 

C&C-1 

C&C-2 

C&C-3 

• Three fully redundant MDMs 

• All powered on 

• One operating as Primary 

• Located internal to US Lab 

• Process commands from Mission Control Center-Houston and PCS provide 
telemetry to Mission Control Center-Houston and data to PCS, redundancy 
management for Tier 2 MDMs, and time management. They also control 
station modes, software interface to International Partners, and File Transfer 
management. 

• Emergency and Vehicle Safing: Execute commands to safe vehicle in response 
to an emergency event 

• Manage S-band, Ku-band, ultra-high frequency, audio, video, control high- 
rate data link, and access mass storage device in support Communications 
Outage Recorder function 

• Control Lab Direct Current (DC)-to-DC Converter Units, control RPCM for 

SO and External (EXT) MDMs, control rack power based on switch position, 
execute power and thermal load sheds 

• Control and coordinate attitude control handovers 

• Interface to Robotics Work Station 

TIER 2 

Connected to Command & Control 

Internal (INT)-I 
INT-2 

• Two fully redundant MDMs 

• One powered on 

• One operating as Primary 

• Located internal to US Lab 

• Control most Lab RPCMs 

• Monitor and control of Internal Thermal Control System (ITCS) in Lab/Node 2 
including failure and leak detection/response 

• Atmospheric control, water recovery, fire detection, temperature control 

• Common Berthing Mechanism (CBM) control and safing 

EXT-1 

EXT-2 

• Two fully redundant MDMs 

• One powered on 

• One operating as Primary 

• Located on SO Truss 

• High-level control of Solar Array Rotary Joint 

• High-level control of External Thermal Control System and Thermal Radiator 
Rotary Joint 

• Provides high-level control of: Structural Dynamic Measurement System, 
Common Attachment System, Segment-Segment Attachment System 

• Control of Mobile Transporter 

GNC-1 

GNC-2 

• Two fully redundant MDMs 

• Both powered on 

• One operating as Primary 

• Located internal to US Lab 

• Provide non-propulsive attitude control by controlling Control Moment Gyros; 
generate and supply pointing data 

Power Module 
Control Unit 
(PMCU)-I 
PMCU-2 

• Two fully redundant MDMs 

• One powered on 

• One operating as Primary 

• Located internal to US Lab 

• Monitor and control of Main Bus Switching Units and most Station DC-to- 
DC Converter Units, provides gateway for Photovoltaic Module equipment, 
provides solar array pointing data, monitor and control of some Lab RPCMs, 
control RPCM for PL-2 MDM 

• Control of Photovoltaic Control Unit (PVCU) MDMs 

Payload (PL)-1 
PL-2 

• Two fully redundant MDMs 

• Both powered on 

• One operating as Primary 

• Located internal to US Lab 

• Payload software support 

• Configure, monitor, and control: Automated Payload Switch and Payload 
Ethernet Hub Gateway 

Habitation 
Control Zone 
(HCZ)t - 1 

HCZ-2 

• Two fully redundant MDMs 

• One powered on 

• One operating as Primary 

• Located internal to Node 3 

• RPCM control 

• Monitor and control of Node 3 ITCS including failure and leak monitoring 

• Atmospheric control, water recovery, fire detection, temperature control, 
regenerative life support systems 

• CBM control and safing 


t Initially intended to control the Habitation Module, these MDMs were repurposed after (continued next page) 

that module was deleted from the program. 
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Table 1 . (continued) 


TIER 3 

Connected to Internal Multiplexer/DeMultiplexer 

Node 1 (N1) 

• Two partially redundant 

MDMs 

• Both powered on 

• One operating as Primary, 
one as Secondary 

• Located on PMA-1 

• Also an connected to C&C 
MDM 

• Node 1 monitor and control: fire detection and isolation 

• RPCM control 

• Heater control, cabin pressure monitoring 

• Control CBM 

• Recovery of USOS command and control interface (Mighty Mouse) 

Laboratory-1 

• Located internal to US Lab 

• Smoke detector monitoring, Common Cabin Air Assembly (CCAA) control, 
InterModule Ventilation (IMV) control 

• Low Temperature Loop (LTL) temperature control, Loop Crossover Assembly 
(LCA) valve control, rack flow control 

• Rack power switch monitoring 

Laboratory-2 

• Located internal to US Lab 

• Smoke detector monitoring, CCAA control, IMV control 

• Moderate Temperature Loop (MTL) temperature control, LCA valve control, 
rack flow control 

• Rack power switch monitoring 

• Lab Caution & Warning (C&W) panel control 

Laboratory-3 

• Located internal to US Lab 

• Air revitalization, vacuum system control 

• ITCS rack flow control 

• Rack power switch monitoring 

Airlock 

• Located internal to Airlock 

• Airlock smoke detector monitoring, CCAA, IMV control, depress pump control, 
Battery Charger Assembly, Umbilical Interface Assembly 

Node 2 (N2) 

• Located internal to Node 2 

• Node 2 smoke detector monitoring, CCAA, pressure monitoring, IMV control 

• Node 2 control and monitoring 

• Rack power switch monitoring 

• Node 2 C&W panel control (N2-2 MDM) 

• Japanese Experiment Module C&W panel control (N2-1 MDM) 

Connected to External Multiplexer/DeMultiplexer 

SO-1, SO-2 

• Two partially redundant 

MDMs 

• Both powered on 

• Operating as bus controller 
(BC) on different buses 

• Located on SO Truss 

• Structural Dynamic Measurement System 

• Heat exchanger control, some External Thermal Control System monitoring 
and Failure Detection, Isolation, and Recovery 

• SO RPCM control 

SI-1, SI-2, PI- 
1, PI-2 

• Two partially redundant 

MDMs 

• Both powered on 

• Operating as BC on different 
buses 

• Located on S1/P1 Truss 

• Thermal Radiator Rotary Joint control, SI-1/PI-2 MDMs provide primary 
External Thermal Control System insight, SI-2/PI-1 MDMs provide External 
Thermal Control System pump commanding 

• S1/P1 RPCM control, SI MDMs control RPCMs for SI and Starboard Thermal 
Radiator MDMs, PI MDMs control RPCM for PI MDMs 

S3-1, S3-2, 

P3-1, P3-2 

• Two partially redundant 

MDMs 

• Both powered on 

• Operating as BC on different 
buses 

• Located on S3/P3 Truss 

• Solar Array Rotary Joint control, S3/P3 RPCM control, S3 MDMs controls 
RPCMs for S3 MDMs, P3 MDMs controls RPCMs for P3 MDMs 

Starboard 

Thermal 

Radiator, 

Port Thermal 
Radiator 

• Located on S1/P1 Truss 

• Radiator beam insight and commanding 


(continued next page) 
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Table 1 . (continued) 


Connected to Power Module Control Unit Multiplexer/DeMultiplexer 

P4 PVCU-2A, 

P4 PVCU-4A 

S4-PVCU-1A 

S4-PVCU-3A 

P6-PVCU-2B 

P6-PVCU-4B 

S6-PVCU-1B 

S6-PVCU-3B 

• Two fully redundant MDMs 

• Both powered on 

• One operating as Primary 

• Located on respective Truss 
Segment 

• Control power generation through pointing of Beta Gimbal Assemblies, control 
energy storage by control of Battery Charge/Discharge Units, monitor battery 
units, control, monitor, and provide control for Sequential Shunt Units and DC 
Switching Units 

• Control Photovoltaic Thermal Control System 

Connected to Habitation Control Zone Multiplexer/DeMultiplexer 

Node 3-1 
(N3-1) 

N3-2 

• Located internal to Node 3 

• No redundancy 

• Node 3 smoke detector monitoring, CCAA, pressure monitoring, IMV control 

• Node 3 MTL [N3-1J/LTL [N3-2] control and monitoring 

• Rack power switch monitoring 

• Node 3 C&W panel control [N3-1 MDM] 


The European and Japanese modules 
each have their own computer 
systems that monitor and control 
all the systems in that module. The 
primary computers in each module 
are Tier 2 computers underneath the 
CCS. On the Russian Segment, the 
computer system is also broken down 
by tiers, but with less resolution. 

The main computer on the Russian 
Segment consists of the SMCC, 
which is analogous to the C&C 
system on the USOS. The main 
connection between the segments 
for data transfer is between the 
SMCC and the CCS. Although the 
SMCC contains three computers, 
these systems are not redundant 
boxes such as the CCS, but are 
rather a voting block similar to the 
General Purpose Computers (GPCs) 
on the Space Shuttle. Specifically, 
all three computers are always 
operating, processing commands and 
telemetry; however, if one reports 
a discrepancy, it is voted out and 
the other(s) continue(s) without the 
malfunctioning computer. The three 
Service Module Terminal Computers 
(SMTCs) operate in a similar fashion. 
The SMTCs connect to, and parallel, 
the USOS GNC computers. Other 
functions such as thermal control and 


life support are spread out between 
the SMCC and SMTC systems. 

Multiplexer/DeMultiplexer 

The MDM is at the core of the C&DH 
system on the USOS. Multiplexing 
is the process of taking data from 
many inputs and formatting them 
into a single continuous data stream. 
Demultiplexing is the reciprocal 
process of breaking a single stream 
into its basic components and 
transmitting the resulting data to 
the required end user. These data, 
or telemetry, contain the details 
of everything about the spacecraft 
ranging from temperatures of items 
(e.g., the fragile aluminum shell of 
the ISS), to angles of articulating 
components such as the solar arrays, 
to the attitude and velocity of the 
vehicle. It also includes the health and 
status of the MDMs. 

An Intel 386 processor is at the heart 
of most MDMs. In an age of ever- 
more-powerful computer chips, this 
may seem ridiculously antiquated; 
however, this processor has enough 
computing power to get the job done. 
The lag behind current technology 
is due to the life cycle of computer 


hardware development. Designing 
a spacecraft, testing and certifying 
an item for the space environment, 
building the hardware, and finally 
implementing on orbit takes many 
years. For computers that evolve 
yearly, this may overlap several 
generations of improvements. Since 
the faster chips are also thinner, 
they are much more susceptible 
to radiation interference in space 
causing the computer to lock up. 

This is not acceptable for the MDMs 
that control critical functions. 

There is generally little need or 
ability to upgrade the MDMs in 
most spacecraft, once the MDMs 
are in operation. However, the ISS 
MDMs were designed such that 
improvements could be incorporated 
if the need and money were available. 
The major limitation of the MDM 
is not the processing speed, but 
rather the memory available and the 
communications network. As some 
of the functions on the ISS evolved, 
especially the Ku communications 
systems (see Chapter 13), the CCS 
processor was upgraded to the 
Enhanced Processor and Integrated 
Communications card, which 
contained a Pentium chip. 
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Table 2. Comparison between the Standard MDM with the Enhanced Unit. In recent years, the C&C, GNC, PL, and EXT MDMs were upgraded as indicated 
in parentheses. See also Chapter 6. 


Component 

Function 

Standard MDM 

Enhanced MDM 

80386 Processor Chip 
(Pentium 266 MMX) 

Microprocessor (CPU) of the MDM 

12 MHz 

16 MHz (144 MHz) 

Electrically Erasable 
Programmable Read-Only 
Memory 

Nonvolatile storage area for the MDM and 
application software. This includes the 

MDM boot-up software. 

1 MB 

1 MB 

Dynamic Random Access 
Memory 

Volatile storage area where applications 
execute 

2 MB 

8 MB (64 MB) 

Analog to Digital Chip 
Converter 

Converts analog data received from I/O 
cards to digital data 

Present 

Present, but only to measure the 
internal temperature of the MDM 

Math Coprocessor 

Chip that assists the CPU in performing 
certain types of operations increasing the 
computer’s speed 

Not present 

Present 


The ISS MDMs come in two styles: 
standard and enhanced. Table 2 
lists the basic properties of the ISS 
MDMs. The main difference is that 
the enhanced ones have a bit more 
memory (8 MB versus 2 MB), 
a faster processor (16 MHz vs 
12 MHz), and can hold an additional 
memory card whereas the others 
cannot. The standard MDMs come 
in several sizes depending on how 
many I/O cards they can hold; i.e., 4, 
10, or 16. MDMs within a class are 
interchangeable. Whole boxes are not 
generally retained as spares on orbit, 
but a few generic MDMs or spare 
cards are present. If a specific MDM 
experiences a fatal failure, a new box 
or card is installed and the appropriate 
software is installed. Not all enhanced 
boxes contain a hard drive. Tier 1 and 
Tier 2 MDMs are of the enhanced 
type. Since the standard MDMs do 
not need to read data off of a disk or 
store data, they do not require hard 
drives and, at that point, resemble a 
tablet more than a desktop PC. All 
the system software is resident in 
nonvolatile electronic memory on 
a circuit card. Figure 2 shows the 
layout of a basic MDM. Two of the 
enhanced MDMs—C&C and Payload 



Figure 2. Photographs of an MDM. The top picture shows the MDM with all the various computer 
cards. The SSMMU is the wide device at the right of the card set. A picture of the computer cards is 
shown in the bottom image. 
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When Computers Crash 

The C&C and PL MDMs were launched in 2001 with MSDs. Primary use 
for the disk was to store the operating software that could not fit into the 
nonvolatile memory. The C&C MSD also functioned as a telemetry recorder 
for later playback when the ISS was out of communication with the ground, 
as well as a staging place for uplinking or downlinking data files. NASA 
accelerated a planned upgrade to newer SSMMUs in the summer of 
2001 after the hard drives on all three C&C MDMs failed during the Space 
Transportation System (STS)-100/ISS-6A mission due to damage on the 
delicate surface of the disks. In 2004, the CCS software was redesigned to 
fit as a zipped file in nonvolatile memory so that the system could almost 
always boot up for most failures. In the initial design, display data needed 
for the crew’s PCS displays resided as files on the C&C MSD, which were 
transferred over when the crew activated that display. However, these 
displays would not work with a failed MSD, so they were moved to spare 
memory of the High Rate Data Link card. When the MSDs failed during and 
after STS-100/ISS-6A, identical units from the PL MDMs were removed, 
installed into the C&C MDMs, and reformatted. The CCS software was then 
completely reloaded onto the drives. 


(PL)—come with additional memory 
storage. Initially, this storage was in 
the form of a 300 MB Mass Storage 
Disk (MSD). This was actually a 
spinning magnetic disk commonly 
found in most desktops. In 2001, 

Solid State Mass Memory Units 
(SSMMUs) with 2 MB flash memory 
cards replaced the disks. A High Rate 
Data Link card provides the interface 
to the MSD/SSMMU. 

Since sensors come in a variety 
of types (e.g., analog, digital), the 
Tier 3 MDMs contain a number of 
I/O computer cards that transmit the 
data. The measurement of temperature 
or voltage are examples of analog 
data in that the sensor will read the 
value (e.g., 15.3°C [59.5°F]) and 
transmit that number to the computer. 
Data that are discrete in that they 
report binary data use digital cards. 

Of course, even the analog data are 
sampled and digitized—like music is 
sampled and digitized on a compact 
disc—so that the data may easily be 
transmitted to the ground. These cards 
are summarized in Table 3. 

MDMs communicate over a network 
of busses that consist of twisted 
copper lines using the Military 
Standard 1553 communication 
protocol. This protocol may be a bit 


old, but it is well tested and robust, 
and has been used on aircraft and 
military ships. Originally, the design 
of the Space Station Freedom, which 
was to use as much groundbreaking 
technology as possible, called for 
a fiber-optic computer network. 
However, when this proved too 
costly, copper cables that did limit 


data transfer rates were adopted. The 
copper wire busses actually consist 
of two separate-but-identical cables 
called channels. If an MDM is having 
trouble talking to another device on 
one channel, the system will switch to 
another channel and try talking to that 
channel. Each channel’s wire is also 
physically separated from the others. 


Table 3. Summary of Standard MDM Card Properties 


Input/Output Card 

Typical Use 

Number of 
Channels 

Number of Cards 
on the International 
Space Station 

Low-level Analog 

Reads analog voltage or supplies the current source to 
measure the drop across a Resistive Temperature Device. 
Mainly used for precise temperature measurements. 

32 

57 

High-level Analog 

Reads analog sensors (pressure, flow rate, speed). 

32 

24 

Analog Input/Output 

Drives analog effectors (valves and switch positions) and 
reads voltages. 

16 

22 

Digital Input/Output 

Reads discrete sensors (valve and switch positions). 

32 

54 

Solenoid Driver Output 

Activates and deactivates solenoids and valves. 

16 

26 
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This provides redundancy throughout 
the network, protecting against such 
problems as high-velocity debris 
hitting the ISS or a fire that may 
disable a single channel. 

Data are transmitted at multiple rates 
at the same time (0.1 Hz, 1 Hz, and 
10 Hz), the higher speeds being for 
the most critical items. A controlling 
MDM is called a bus controller (BC) 
as it sends out commands and timing 
signals to all the devices on the bus 
and, in turn, reads the status telemetry 
that is transmitted by the client 
MDMs. Any device that is listening 
on the bus is known as a Remote 
Terminal (RT). The BC will send a 
command to an RT and the RT will, in 
turn, report the status of that command 
back to the BC. Thus, a command 
to open a valve might have to travel 
from the ground, over to White Sands 
Test Facility, up through the Tracking 
Data Relay Satellite System (see 
Chapter 13) and over to the ISS on 
S-band, and be received by the C&C 
MDM, transmitted to a Tier 2 MDM, 
and routed by the Tier 3 computer 
to the destination device before the 
action takes place. The status of the 
command on the RT is then routed 
along the reverse path to the flight 
controller’s computer display—a 
process that must occur within 
seconds of sending the command. 

The MDMs have several different 
operating states, but generally there 
are three main ones. The first is an 
interim state called Standby. After 
booting up, the MDM is ready to 
perform its role but is not actually 
doing anything. This is similar to 
a desktop computer having booted 
up but with no applications having 
been launched. At this point, the 
MDM is a remote terminal on 


the bus, listening for commands. 
Some MDMs will transition to the 
Operational state automatically, 
whereas others require commanding. 
At this point, the MDM can 
exchange commands and telemetry 
between the lower computers or 
sensors on the busses underneath it, 
which means it is now the BC and 
is fully operational. Where there are 
redundant MDMs, only one can be a 
BC; the other MDM stays in Standby 
or Backup. As with earthbound 
computers, MDMs can fail at any 
time; however, due to extensive 
testing, such failures are rare. If the 
computer hardware fails or locks 
up, the computer is no longer a BC. 

If the software detects something 
wrong (e.g., a numerical value out of 
valid range), rather than lock up in 
an analogous “blue screen of death,” 
the MDM will usually automatically 
enter the Diagnostic state. This is 
similar to the safe mode on most 
desktops or laptops. In this state, the 
flight control team can look at health 
and status indicators to determine the 
problem. Generally, these errors are 
transient mistakes fixed by patching 
computer code or rebooting. 

The C&C MDMs are configured as 
an operational Primary, a Backup 
ready to take over instantly, and a 
Standby. This is unlike the Russian 
system where multiple duplicate 
units run simultaneously, comparing 
data and voting on the results. If the 
Primary should fail or be commanded 
out of its role by the ground 
control team, the Backup would 
take over almost instantaneously. 
Whereas some reconfiguration of 
the system would be required, most 
critical functions are ready to take 
control. Some configuration can be 
commanded to the Backup while 


additional status information is 
routinely “check pointed” between 
the MDMs to ensure a smooth and 
expeditious transition. The Standby 
would take over directly as Primary 
if the other two MDMs should fail; 
however, additional configuration 
is required since no check point 
data or configuration is available 
in the Standby mode. (Although 
exchanging check point data is 
efficient in keeping computers in 
synchronization, it can potentially 
propagate some software error and 
therefore is blocked to the Standby.) 
However, the nominal case would 
be for the MDM to transition to the 
Backup role after a Primary MDM 
has failed or been commanded out 
of operations automatically, where 
the operators would then configure it 
as a Backup. 

Time is one of the most critical 
parameters on the ISS for several 
reasons. First, time is critical for 
knowing the location of the ISS 
in its orbit. Traveling at a speed 
of nearly 8 kilometers/second 
(5 miles/second), a few seconds 
of error can quickly turn into large 
uncertainties in distance. Location 
accuracy is crucial when another 
vehicle is coming to the ISS or for 
pointing the Ku antenna precisely 
at a Tracking and Data Relay 
Satellite. Second, with such a large 
number of computers, it is important 
that information is exchanged 
carefully. The CCS acts as the global 
timekeeper on the ISS. Basically, it 
sets the time, and all other computers 
in the C&DH system synchronize to 
it. Although computers can maintain 
time fairly accurately, no two 
oscillators behave exactly the same. 
The oscillator essentially acts like 
a clock pendulum. Two computers 
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that are synchronized will eventually 
drift apart as the “pendulum swings” 
of their oscillator are different. For 
the computers used on the ISS, 
the difference is on the order of 
milliseconds. Still, information can 
get garbled as it passes back and 
forth due to these differences. For 
example, a command might not 
reach its correct destination because 
one computer is trying to pass it to a 
second computer that is not ready to 
receive it. If an MDM gets ahead of 
or behind the CCS, it will adjust its 
pendulum swing in the oscillator to 
drift back to the correct time before 
the difference becomes too large. 

Upon boot up, the default time in 
the C&C MDM is January 1, 1992 
(the time when the GPSs were 
initialized), not unlike a digital clock 
that defaults to 12:00 when first 
plugged in. Thus, the time in the 
C&C MDM needs to be reset. This 
can be accomplished in multiple 
ways. Most modem spacecraft use the 
GPS time, due to its accuracy. The 
GNC system has multiple antennae 
to receive the GPS signals for this 
purpose. Unfortunately, these signals 
can become interrupted or confused 
when, for example, some of the 
signal is reflected off parts of the ISS 
to the antenna. This can create the 
undesirable effect of causing the time 
value to jump around. The lower- 
tier MDMs, designed to gradually 
drift their own clocks to keep up 
with the C&C, cannot respond 
fast enough. When this happens, 
lower-tier computers can become 
unsynchronized with the CCS. 
Therefore, the ODIN/CRONUS flight 
controller monitors the CCS time 
and manually adjusts its oscillator to 
maintain GPS time. 


Portable Computer System 

The PCS is the crew’s interface with 
the station’s computer system. With 
the PCS connected to the C&C MDM 
via a special cable to a 1553 bus, as 
shown in Figure 3, the crew can send 
commands to the vehicle and receive 
the status of most systems. As many 
as eight PCS laptops can be connected 
at any given time. These laptops are 
distributed around the ISS in areas 
where the crew will be working. 

The PCS is currently an IBM T61 
laptop with a duo-core processor, 
which is in line with the goal of using 
as much commercial off-the-shelf 


equipment as possible. The PCS has 
the same hardware, although not 
the critical software, as the crew’s 
SSC so that spares can be swapped 
back and forth easily, as needed. 
Basic parameters of the PCS are 
listed below. The PCS platform 
is the Scientific Linux operating 
system, based on UNIX, which uses 
a graphical windowing environment 
based on X-Windows. Both the PCS 
and the SSC can talk to a printer. 

As the crew’s primary systems 
interface, the PCS needs to provide 
easy-to-use software that is intuitive 
to an astronaut of any nationality, 
especially during an emergency. 



Figure 3. The PCS consists of a laptop with specially written software that plugs into a Utility Outlet 
Panel using a dedicated junction box that converts the station power to standard 120 V as well as a 
1553 data cable. This panel provides electricity as well as a 1553 data connection to the CCS. 
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Table 4. Basic Parameters of the PCS 


Features 

Specification 

Processor 

2.5 GHz core duo 

Memory 

4 Gb RAM 

Hard Drive 

160 Gb 

Battery 

2.0-hour lithium ion battery 

Display 

39 cm (15.4 in) diagonal LCD display with active matrix 1920 x 1200 pixel resolution, 256 colors 

Dimensions 

4 cm x 36 cm x 2128 cm (1.4 in. x 14 in. x 11 in.), 2.7 kg (6 lb) with battery and DVD drive 

External Power Supply 

28 V DC or 120 V DC 

Expansion Slot 

Single slot for 1553 interface connector 

Peripherals 

DVD-RW/CD-RW 

Pressure Range 

456 mm Hg (9.0 psi) to 827 mm Hg (16.0 psi) 



Figure 4. An image of the home page on the PCS. Each module of the ISS is represented. In addition, the astronauts can navigate to a specific system using 
one of the icons on the right side of the screen. From top to bottom: C&DH, communications and tracking, life support, power, attitude control, mechanical 
(not used), thermal control, extravehicular activity, medical, racks (not used), robotics, and emergency escape system (not currently used). Certain functions 
such as viewing the listing of commands (“Cmd Log”) issued by the laptop, a summary of fire or rapid depress status, or other miscellaneous tools can be 
accessed on the left side of the screen. Visiting vehicles such as the Automated Transfer Vehicle are also shown, when appropriate. 
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The home page Graphical User 
Interface (GUI) is shown in Figures 4 
and 5. At a high level, the home page 
is a graphical representation of the 
ISS. Crew members can examine the 
status of all the systems in a specific 
module by clicking on the appropriate 
icon. Alternatively, the crew can 
examine all aspects of a particular 
subsystem by selecting the icons for 


that system along the right side of the 
screen. Since the ISS is occupied by 
people from many different cultures, 
generic icons (e.g., a lightning bolt 
for the electrical system) are used as 
much as possible. The GUI graphics 
are integrated into the station’s 
Caution and Warning (C&W) system. 
For example, a module is highlighted 
red or yellow if a subsystem in that 


module is experiencing an alarm. 
Some emergencies, such as fire or 
toxic atmosphere, can result in the 
entire crew being isolated in the 
Russian Segment. A PCS is always 
maintained in that segment so that 
insight of the USOS is retained, even 
if the crew is temporarily cut off. 





Figure 5. Alarm trace. The crew can use the PCS to zero in on the cause of 
an alarm. On the home page, a module will turn the color of the alarm class 
(top left). In this case, the electrical system and environmental systems in 
Node 3 and the P6 segments indicate an alarm. The crew selects the module 
that, in the example, shows a caution-level event in the Node 3 Environmental 
Control and Life Support System (top right). The control page for the rack 
shows (lower right) that the Carbon Dioxide Removal Assembly is in alarm. 
Selecting that module brings up a detailed page where the crew and ground 
can isolate the fault and perform further troubleshooting (bottom left). 
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Caution and Warning 

One of the most critical functions 
of the C&DH system is that of 
C&W. Alarms, or C&Ws, come in 
four classes. The most dangerous 
problems for a crew are fire, rapid 
depression of air, and toxicity in 
the atmosphere (i.e., from a leak 
in the ammonia cooling system, 
failed environmental equipment, 
or a spilled experiment). These are 
class 1 alarms (emergencies). Class 

2 alarms (warnings) indicate that 
the crew or ground needs to take 
immediate action to avoid injury or 
death of the crew or damage to the 
ISS. Emergencies and warnings are 
indicated by red on displays. Class 

3 alarms (cautions) are indicated by 
yellow and do not require immediate 
response by the crew or ground; 
however, if left uncorrected, such 
situations could develop into a 
warning-class event. The lowest 
level of alarms (advisories) indicate 
something is wrong that does not 
require immediate attention. These 
are more akin to the “check oil” 
light on a car. A special subset of 
advisories is the robotic advisories, 
which provide alerts for the robotic 
systems only. The number of 
alarms include approximately 80 
emergencies, 800 warnings, 2300 
cautions, and 6100 advisories. The 
majority of alarms indicate a failure 
of a redundant component, thereby 
posing no immediate threat. Failures 
are detected by an MDM in the 
chain and fed to the C&C MDM, 
which, in turn, determines the level 
of the alarm and routes it to audio 
speakers, light panels, and the PCS 
to alert the crew and ground. Most 
modules contain speaker systems for 
annunciating an audible alarm, much 


Figure 6. The C&W panel. Each button will illuminate red or yellow as appropriate to indicate the 
presence of an alarm. The crew will push the button to either manually initiate an alarm, or to silence the 
tones. A glass cover protects against crew members accidentally bumping one of the emergency alarms. 



Figure 7. The C&W Summary used by the crew and flight control team in mission control. Events 
that are actively in alarm are indicated with yellow or red, depending on the class. Less-critical 
advisories are shown in white. Text describing the alarm is shown in the middle, followed by the time 
the alarm annunciated (in Greenwich Mean Time). The bottom displays a log of events and history 
(e.g., in alarm, normal). 


like a fire alarm in public buildings. 
Each class, except advisories, has 
a distinctive frequency to allow the 
crew to differentiate between alarms. 
Advisories do not produce an audible 


alarm. Distinctive frequencies are 
required because one anomaly (e.g., 
a fire) could produce multiple class 
failures and the crew needs to know 
quickly which is the most critical. 
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Many modules possess C&W panels 
with colored lights that indicate an 
alarm is present (Figure 6). Pushing 
a button on the C&W panel will 
silence the alarm tones until another 
failure occurs. Crew members can 
manually initiate an alarm by pushing 
an alarm button on the panel if, for 
example, they detect something 
such as smoke that the automated 
systems failed to detect. Each alarm 
also has an associated detailed text 
message that is displayed in the C&W 
Summary. This text message explains, 
in English, the nature of the failure 
(Figure 7). Generally, the ground 
will try to work most events unless a 
long period without communications 
(either scheduled or unplanned due to 
a failure) is anticipated. 

If an individual alarm becomes 
a nuisance, it can be “inhibited” 
to prevent disturbing the crew 
unnecessarily. In this case, the system 
completely ignores the alarm and no 
one, not even the ground, is alerted. 
An example might be the water level 
of a condensation tank. If the level 
is oscillating right above and below 
a critical level, the alarm might be 
triggered repeatedly. If it is deemed 
noncritical and the ground can 
monitor the level closely, the alarm 
is then inhibited. The audio alarm 
also could be suppressed when the 
crew might need to be alerted to an 
alarm eventually but not immediately. 
In this case, the lights would still 
illuminate and the message would be 
present on the PCS, but no alarm tone 
would be issued. Thus, the crew and 
ground could monitor the situation 
without being deafened by the loud 
tones. This is especially useful during 
crew sleep periods. 


Software 

The software executing in each 
MDM, the User Application 
Software, is unique to the function of 
that particular MDM. For example, 
the software executing in the GNC 
MDM contains routines that are 
needed for attitude control and 
navigation. Different software runs 
in the External MDM, which is 
mainly concerned with controlling 
the solar arrays and the External 
Thermal Control Systems. Utilities 
such as communicating on the bus 
are common between all the MDMs 
(although with a few minor deviations 
developed across the different 
systems). Different segments of 
Boeing, the prime ISS contractor, 
produced different software systems. 
All combined, the ISS C&DH system 
consists of approximately 1.8 million 
lines of computer code. 

Sometimes, software needs to be 
changed. This can be accomplished 
in two different ways on the ISS. 

First is through the use of a Pre- 
Positioned Load (PPL). A PPL is a 
file of data parameters or commands 
that can be uplinked by the flight 
controllers at any time to change 
specific values. For example, a 
critical PPL is the one that controls 
load sheds. A load shed occurs if 
the Electrical Power System cannot 
produce enough electricity. This 
could happen if the guidance system 
failed and the ISS was no longer 
able to point the solar arrays at the 
sun. If a load shed is triggered, the 
PPL will execute the commands 
inside of it to power off the least- 
critical equipment first and then 
pause. If the power problem is more 
severe, the flight control team or the 


automatic software will resume the 
execution by the PPL, thus powering 
off additional equipment. This list 
of equipment also changes as the 
station changes (e.g., if modules are 
added or moved); therefore, the PPL 
is periodically updated. Alternatively, 
the temperature at which a heater 
turns on or off might need to change, 
just like adjusting the thermostat 
in a house. Rather than change the 
software code, the software looks at a 
particular value defined in the PPL. If 
this needs to be changed for whatever 
reason—say, from 18°C (64°F) to 
15°C (59°F)—a new value is set in 
that particular PPL. The software 
itself can also be updated. This is 
discussed further in Chapter 6. 

Another critical function of the 
C&DH system is to recover the 
function lost when a failure occurs. 
This software is generally referred 
to as Failure Detection, Isolation, 
and Recovery. The software will first 
detect the failure of a component 
and annunciate a C&W message, 
depending on the severity. Many key 
ORUs on the ISS have what is called 
a heartbeat—basically, software that 
is constantly counting up. If this 
number is changing, the ORU is alive. 
A static heartbeat means the ORU 
is no longer healthy. Many systems 
that die will also loose computer 
communications with the MDM. 
Isolation refers to the software taking 
an action to put the system into a safe 
configuration. For example, if a valve 
is stuck closed in the cooling system, 
the pump can be damaged by trying 
to push fluid against it. This is called 
dead heading. The isolation software 
will turn off this pump. Recovery 
means that a backup system, if 
available, would be turned on. 


SYSTEMS: COMMAND AND DATA HANDLING-THE BRAINS OF THE INTERNATIONAL SPACE STATION CHAPTER 5 


105 



A special case occurs when an 
MDM fails. Among the MDMs, 
the C&C performs the recovery of 
the Tier 2 MDMs since they are 
redundant. Upon detecting a loss of 
communication with a Tier 2 MDM, 
the C&C will power on the Backup 
(normally kept off to minimize 
wear and tear) and command it 
operational. This process is called 
Redundancy Management (RM). 

A serious scenario, such as a major 
power channel failure, can cause 
multiple components, including 
MDMs, to be powered off. The CCS 
will perform RM on each Tier 2 
MDM that failed, beginning with the 
most critical MDM. As the Tier 2 
MDMs are recovered, they will detect 
any problems in their systems and 
will execute automated software to 
reconfigure their system, including 
bringing online redundant equipment. 
For example, the same power channel 
failure that powered off an active 
INT MDM could have left half the 
pumps for the internal cooling system 
unpowered in the Laboratory Module. 
The newly recovered INT MDM will 
detect one pump as off (“failed”) and 
reconfigure the water loops so that the 
remaining pump is cooling the entire 
system. Flight controllers will then 
do any further cleanup of the less- 
critical systems. Critical equipment, 
including MDMs, are usually put on 
different channels to minimize such 
impacts from the failure of a single 
power or cooling channel. Thus, if 
C&C-l MDM is the Primary MDM, 
the INT-2 MDM on a different power 
channel may be configured as the 
Primary for that pair so that an issue 
with the power system is unlikely to 
power off both at the same time. 

Another key function of the software 
relates to what are called modes. The 
ISS is a large, complicated system. 


When the vehicle is reconfigured 
for key activities—e.g, preparing 
for the docking of a visiting 
vehicle—a lot of systems have to be 
changed to support the new mode 
or configuration. Mode transitions 
are automated to help relieve the 
work of the ground team. When the 
ISS is supporting regular increment 
operations, it is in Standard mode. 
The ISS transitions to Proximity 
Operations mode for visiting vehicle 
dockings. When the command is 
given, the C&C MDM will fire off 
a large number of commands to all 
the systems to configure the systems 
appropriately. Other modes include 
Microgravity, Reboost (for raising 
the station altitude), and External 
Operations (intended to be used for 
extravehicular activities). A Survival 
mode attempts to maintain the 
minimum systems required to keep 
the crew alive. 


Assembling the Command 
and Data Handling System 

Assembling the C&DH system was 
relatively straightforward, unlike 
several other systems described 
elsewhere in this book. Adding a 
computer to the network on the 
ISS is not all that different from 
adding a computer on a home or 
work network—with one notable 
exception. Prior to ISS-5A, the only 
USOS MDMs were the Node MDMs 
and the P6 Photo Voltaic Control Unit 
(PVCU) MDMs. The crew would 
interface with the Node Control 
Software using the early PCS. At 
5 A, a number of MDMs were added 
and the PCS became the permanent 
method for crew interaction with the 
C&DH system. Transitioning from 
Node software to CCS control at 5A 
was the biggest expected challenge 


for the ODIN team during the ISS 
assembly process. 

The Node Control System (NCS) 
assumed interim C&C upon power- 
up in 1998 of the first element of 
the USOS—Node 1. The NCS 
controlled some fans and connected 
to the Early Communication System, 
which was used for talking to the 
crew and getting status telemetry 
on the ground. Later, at 4A, the 
Node MDMs worked with the 
PVCU computers on the P6 module 
to provide power. The Laboratory 
Module, launched in 2001, contained 
the CCS, which was destined to 
be the Tier 1 C&C as well as the 
INT, EXT, and GNC MDMs. The 
challenge is that the station cannot 
be without a Tier 1 computer for 
extended periods of time, and there 
can be only one Tier 1 controller 
at a time. Therefore, a careful 
handover from NCS to CCS had to 
be developed. Fortunately, a function 
designed to recover the C&C MDMs 
in the event of a failure provided a 
clever mechanism to achieve this. 

The NCS is technically a Tier 2 
system under the CCS. Early on, 
it was realized that, in the unlikely 
event of all three C&C MDMs 
failing, there needed to be a way 
to power cycle them in the hope of 
recovering them (much as a desktop 
or laptop can be recovered if a 
software lockup occurs). If that effort 
was not successful, there needed to be 
a way to assume control of the ISS. If 
all three C&C MDMs were to fail, the 
NCS would detect the absence of a 
BC and begin power cycling the C&C 
MDMs. The NCS would then give 
up the bus control to allow the CCS 
to boot up and take charge. If, after a 
certain amount of time, the NCS still 
detected no BC, it would go back to 
controlling the main busses until the 
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flight controllers reconfigured the 
system. Although the NCS cannot 
really communicate with the INT, 
EXT, or GNC MDMs, it would still 
provide the crew with at least a small 
amount of insight and control. Since 
the Node MDMs were the “little 
guys” compared to the “big” C&Cs, 
this software process was dubbed 
Mighty Mouse, based on the old 
American television and film cartoon. 

Activating the Laboratory Module— 
the brains of the US OS—at 5 A was 
a bit of a chicken-and-egg dilemma. 
Computers were needed to operate the 
systems, but they generated heat as 
did the other systems coming online. 
Therefore, the Thermal Control 
System needed to be activated as 
soon as possible to provide cooling 
to the computers already activated 
before they overheated. The Thermal 
Control System, of course, needed 
computers to operate. A variation of 
Mighty Mouse software was used to 
affect the handover of control from 
the Node to the laboratory during 
STS-98/ISS-5A. The successive 
waves of power cycling various 
C&C MDMs, followed by waiting 
for signs of life, were stripped out 
in the software to save time on the 
assumption that the C&C-l MDM 
would not be failed at the start of its 
life on orbit. Instead, the NCS would 
power on C&C-l, relinquish control 
of the busses, and wait to either 
detect the CCS or resume control if 
unsuccessful. This software was now 
dubbed Minnie Mouse, based on the 
Disney character and building on the 
mouse theme. Upon transitioning 
to its normal Operational mode, 
the CCS would see no INT MDM, 
thus triggering RM to initialize the 
INT MDM. During the mission, the 
astronauts would command the Node 
computers into Minnie Mouse mode. 


The flight controllers and astronauts 
would hold their breath for 5 minutes. 
If it worked, automated software 
would begin configuring the rest of 
the systems. If it didn’t work, the ISS 
could be left in some limbo state with 
no computer in charge. Fortunately, 
everything executed flawlessly. 

The new MDMs were integrated 
relatively seamlessly as new 
modules were added to the ISS. 

Upon activation of the module, 
the new Tier 2 or Tier 3 computers 
would immediately transition to an 
operational mode and begin talking 
to the next-higher level. From 
about 2000 to 2014, the C&DH 
system grew from two MDMs to 46. 
Major software upgrades have 
occurred about once per year (see 
also Chapter 6). 

Conclusion 

Unlike previous manned spacecraft, 
the ISS is almost completely 
controlled by computers. The 
computer system runs every 
spacecraft function from controlling 
the solar arrays to keeping the power 
generation going to communication 
with the ground. It also reconfigures 
other computers and hardware in the 
event of a problem. These failures are 
annunciated to the crew and ground 
through various cautions and warning 
with lights and audible tones. While 
the flight controllers on the ground 
communicate through the ISS via the 
C&C MDMs, the crew interface with 
a laptop called the PCS. Finally, as 
with the ISS itself, the C&DH system 
has evolved over the years, most 
notably by upgrades to the software 
and sometimes the hardware, as is the 
case with terrestrial computers. 


SYSTEMS: COMMAND AND DATA HANDLING-THE BRAINS OF THE INTERNATIONAL SPACE STATION 


CHAPTER 5 


107 




Chapter 6 Day in the Life: 

“Brain Transplants” 
on the International 
Space Station 
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Flowchart showing the 1-year process required to plan and execute a software upgrade to the major systems on the International Space Station. Each block 
represents a milestone. The upper-left box indicates how far in advance of the transition (T) the activity should start. The upper-right box indicates when the 
activities should be complete. In this example, the actual completion dates for the Release 14 update (described below) are indicated in red above each box. 


Terrestrial computers need 
to be periodically updated to 
accommodate new features, fix 
bugs, or address compatibility 
issues as other systems evolve 
over time . Software on the 
International Space Station (ISS) is 
no different in that way. Where the 
software on the ISS does differ is 
that every vital function of the space 
station is controlled by a computer and 
cannot be suspended while software 
is changed. Critical ISS systems 
cannot afford to simply wait while 
updates are applied and computers are 
rebooted. The two main reasons for 
updating space station software are to 
install upgrades for new features and 


to fix problems. The development of 
the software was staggered over time, 
particularly over the ever-changing 
configuration of the ISS during its 
construction. There was no point in 
having software that performed a 
function—say, controlling a cooling 
loop or module—when that loop 
or module was to be installed years 
down the road. It takes years to design 
the code to control the space station, 
and additional years to write and test 
the software before it is installed. 
Furthermore, errors can arise from 
a simple typo when the code was 
written. Rigorous testing catches the 
vast majority of these problems. Other 
errors come from how the coders 


interpreted a software requirement, 
or are due to evolution of the team’s 
thinking as the system matured. If 
an error is critical, the code will be 
updated before it is loaded on the 
space station computers. The update 
to fix bugs that have a noncritical 
impact or that the flight team can work 
around may be made in a subsequent 
release so as to not impact the 
schedule. Considerable care in terms 
of testing, planning, and execution 
is taken when ISS computers are 
updated. If done properly, the crew 
hardly notices any changes. 

The ISS software was first upgraded 
in October 2002. At the time, it was 
the largest software upgrade ever 
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performed in space. The process took 
about a year to plan and execute. 

Since then, similar software upgrades 
have become “routine,” having been 
performed more than a dozen times 
since. To reduce cost and assist with 
scheduling, large-scale ISS software 
upgrades are now planned to take 
place once a year. The entire process 
of identifying changes, developing 
and testing code, and planning and 
executing the transition is ongoing. 
Once a change has been approved and 
implemented in the code, it is included 
in the next scheduled upgrade. 

The ISS hosts three types of 
computers (see Chapter 5). All critical 
ISS functions are controlled by the 
Multiplexer/DeMultiplexers (MDMs). 
The MDMs, and the Portable 
Computer System (PCS) that controls 
them, were designed for regular 
updates. This chapter discusses how 
the operations team prepares for 
and executes this critical task. The 
crew’s Station Support Computers 
are upgraded similarly to laptops on 
Earth and are not discussed here. 

Major upgrades are scheduled about 
once a year due to the complexity of 
the software controlling the ISS. It 
takes many months of planning and 
training to accomplish a software 
upgrade. This schedule allows careful 
development of the transition. In 
many ways, a software transition is 
just as complicated as the execution 
of a spacewalk or the docking of 
a new vehicle. The flight director 
and his or her team work closely 
throughout the year to prepare for 
the upgrade. This chapter describes 
the process of updating the software: 
changing the code, developing the 
complicated plan for installing it, 
testing the plan, executing the plan, 
and recovering from problems during 
the upgrade, as sometimes happens. 


The Life Cycle of Code 

During the design phase of the ISS, 
engineers determined which functions 
the software needed to control. For 
example, consider the operation 
of the massive solar arrays, which 
generate the critical power needed to 
run the space station. The arrays can 
articulate at the Solar Alpha Rotary 
Joint and the Beta Gimbal Assembly 
(see Chapter 9) to ensure they are 
always pointed in the direction of 
the sun. Software tells the arrays 
where the sun is positioned, and 
the motion of the ISS as it orbits 
the Earth. Thus, the arrays will 
slowly move throughout the orbit 
to maximize power generation. 

The arrays are parked and locked 
in a position during the arrival of 
docking vehicles to minimize thruster 
loading on the delicate surfaces of 
the arrays. The software needs to 
know how to move the panels to the 
required position and then use the 
gears to lock them in a fixed position. 
Software will respond if, for some 
reason, the gears have a problem 
and cannot lock properly (similar to 
the way a car’s transmission gears 
crash instead of mesh smoothly). If 
the power controlling these motors is 
lost, software will use alternate power 
or motors to complete the critical 
task. This is just one example of how 
engineers will define all the needed 
software functions and then write 
detailed requirements to describe how 
each function will operate. Flight 
controllers play a part in developing 
these requirements since they are 
the ones who will be operating the 
software that is on the ISS. 

Software engineers then take the 
requirements and generate the code. 
The logic of the code is carefully 
reviewed with other programmers 


to ensure it does what is intended. 
During this phase, the flight 
control team works closely with 
the programmers to understand 
and influence the design. During 
the assembly of the ISS, the flight 
controllers were extremely involved 
in the development of the vehicle 
software. Once completed, the 
software undergoes various levels 
of testing to ensure that it correctly 
meets the requirements and interfaces 
with other software code properly. 
Testing culminates with a flight 
qualification test where the software 
is put through its paces under 
realistic situations. 

In a perfect world, a complete second 
space station would exist on the 
ground to run the software to ensure 
it works correctly; however, such an 
approach is cost prohibitive. Instead, 
testing is done on a combination of 
flight-like items and simulation or 
emulations. A flight-like unit may 
be an exact copy of a unit flown on 
the space station, or it might be a 
flight equivalent unit—something 
very close to the real hardware but 
with cheaper parts that replicate the 
behavior of the real unit. A simulator 
or emulator is essentially a software 
program that will react the same 
as the real system. For example, 
software controls the pump speed 
in the Thermal Control System 
loop, perhaps increasing water 
flow if more cooling is needed (see 
Chapter 11). The simulation will 
reveal the temperature to the MDM. 
The MDM will send a command 
back to the simulation, telling it to 
increase the pump speed. The revised 
pump speed and the resulting cooler 
water temperature are echoed back 
to the MDM. In this way, the control 
software inside the MDM is executed 
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without requiring an actual Thermal 
Control System to be connected. 

Note that this sort of testing has to 
be integrated with all the systems. 
The Command and Control System 
(CCS) software interfaces with the 
Internal, External, and Guidance, 
Navigation, and Control (GNC) 
software, to name a few, as well as 
the Russian, European, Japanese, 
and commercial partner systems. 
Code changes in the CCS have to be 
tested with the latest code in all these 
systems to ensure compatibility. 
Testing between the CCS and the 
Russian computers is some of the 
most complicated owing to the 
critical functions that both segments 
control, and because the systems are 
very different. This is called “four- 
box testing” since it uses flight-like 
items for the four key computers 
(Command and Control [C&C] 
MDM, GNC MDM, Service Module 
Central Computer, and the Service 
Module Terminal Computer) on 
both sides of the interface. Flight 
controllers and engineers from 
multiple countries spend months 
testing the four-box configuration. 

Once the software has passed 
the flight qualification test, it is 
ready to be loaded on the space 
station computers. 


Preparing for the Transition 

Once the software is ready for uplink, 
the operations team—consisting of 
the key personnel from the various 
disciplines along with the flight 
director—begins the process of 
preparing for the actual installation. 
As with a Space Shuttle mission 
(see Chapter 4) or a spacewalk 
(see Chapter 17), a lead team is 
assigned to the project. The process 
of a software upgrade is fairly 
complicated. The first thing the 
team needs is to figure out is the 
strategy—i.e., which computers are 
to be updated and in which order. 
Changes to the CCS will affect other 
Tier 2 computers as well as the 
crew’s PCS and perhaps the robotics 
software. Therefore, changes to 
those computers are usually updated 
around the same time. For example, 
the 14th release of the CCS, called 
Release 14 (R14), was combined 
with seven other operating systems 
on 11 MDMs and PCS laptops. 
Although several computers are 
being upgraded, by convention the 
entire set of transitions is labeled 
according to the CCS software 
being uploaded. The upgrade is 
summarized in Table 1 and represents 
updates to nearly 1.5 million lines of 
software code. 


The transition to the new software 
has to be seamless since the software 
is still controlling the vital functions 
of the space station. Therefore, 
the new software is loaded to the 
backup computer for those systems 
that have a backup. The primary 
and backup computers are swapped 
when the team is ready, during a 
time in which there are no major 
activities such as a visiting vehicle 
docking or a spacewalk. Usually, 
this is accomplished by telling the 
primary to mode itself to a standby or 
diagnostic safe state (see Chapter 5). 
Seeing no primary, the backup 
MDM will transition to that role, 
but will be operating on the new 
software. If a backup MDM does 
not exist, as is the case with the 
Tier 3 MDMs (see Chapter 5), 
the sole computer is loaded in a 
diagnostic state and then transitioned 
to operational when ready. 

Whenever the CCS is upgraded, 
the PCS software is also upgraded 
since both work hand in hand. 

Unlike the MDMs, this can be done 
via CD-ROM (as can be done via 
laptop on Earth) or by sending up 
a new hard drive with the software 
already loaded. Half the PCS laptops 
are converted to the new software 
prior to the transition. Only half 
are loaded to allow for a possible 


Table 1. Summary of software systems upgraded in the R14 group transition. See Chapter 5 for more details on the different MDMs and software systems. 
This is the software transition shown in the flowchart at the beginning of this chapter. 


Software System Old Release -» New Release 

Number of and Computers Affected 

Command and Control Software (CCS) Release (R)13 -> CCS R14 

3 - Command and Control Multiplexer/DeMultiplexers (MDMs) 

Portable Computer System (PCS) R16 -> PCS R17 

7 -PCSs 

Mobile Servicer System (MSS) 8.1 -> MSS 8.2 

3 - C&C MDMs 

Hub Control Software (HCS) R3 -» HCS R4 

2 - Hub Control Zone MDMs 

Starboard 3 (S3) Port 3 (P3) R4 S3P3 R5 

4-S3 and P3 MDMs 

Laboratory System 3 R5 -> LSYS3 R6 

1 - LA-3 MDM 

Node 2 System (N2SYS)2 R3 -> N2SYS2 R4 

1 - N2-2 MDM 
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“rollback” to the old configuration if 
a problem is encountered. 

Generally, the C&C MDMs are 
swapped to invoke the new software. 
The crew connects the upgraded 
PCS laptops that are loaded with that 
software. The ground evaluates data 
to ensure everything is operating 
properly. If all is as it should be, the 
next pair of MDMs is swapped— 
usually the Internal MDM, followed 
by other pairs. The computers with 
the old software are not immediately 
reloaded. An extensive amount 
of testing is performed before the 
computers on orbit are reloaded; 
however, there is always a chance 
that something is missed within the 
simulated environment, which is not 
100% identical to the real vehicle. 
Therefore, the operations team 
typically waits about day to make 
sure everything is working properly. 
If everything works, the computers 
with the remaining old software 
are reloaded and that portion of the 
transition is completed. If not, the old 
software can be rolled back quickly 
by swapping it with the computer 
that is still running the old software. 
The team then determines the best 
configuration for the software until 
the issue can be resolved. The real¬ 
time timeline for the R14 load is 
shown in Figure 1. 

Flight controllers, under the direction 
of the flight director and working 
with the engineers, figure out 
the transition plan, which is then 
reviewed by the engineering team. 
For example, do the systems need 
to be put in a certain configuration 
prior to the transition? Which 
operations must be stopped during 
the transition and which can 
safely continue? Once the plan is 
worked out, the procedures are 



Load R14 into 
Backup & Standby 
C&C MDMs 

a? 

a 

Load R17 into 
half of PCSs 

T 

Day 2 

Transition 

Backup C&C 

MDM to Primary 


• Connect PCS 

• Standby C&C 
r MDM still R13 

CO 

Transition 
Standby C&C 

MDM to R14 

aT 

Q 

Load, transition Prime 
& Backup HCZ to R4 


r 

Day 4 

Load, transition 
LAB-3 MDM to R6, 
Node 2-2 MDM to R4 



Day 5 

Load, transition 

S3-1, S3-2, P3-1, 
P3-2 MDMs to R5 


Figure 1. Graphic illustrates the day-by-day 
process over 5 days of loading all the computers 
for the R14, as defined in Table 1. Each block 
represents a set of activities performed on a 
given day Each step-up is done in small steps 
to allow for time to assess how the software is 
working. If everything was transitioned at once, 
it might be hard to identify a problem. 


written, including some for likely 
contingency scenarios. At that point, 
the procedures are operationally 
tested. In these tests, the flight 


control team in Mission Control 
executes the procedures with the 
ISS Software Development and 
Integration Laboratory in what 
are called flight-like operations 
readiness tests. These tests include 
configuring the simulated systems 
into a known ISS-like state for the 
actual swap, sending all the new 
code to the computers, executing 
the switchover, and reconfiguring 
all equipment back to the normal 
operating setup. Multiple tests are 
performed to ensure everything is 
properly evaluated. Once any issues 
are worked out, a test that uses a 
flight-like mission configuration 
is performed. 

Note that this describes only the 
process to develop the transition 
procedure. New software means new 
operations of generic procedures, 
and possibly new flight rules. 
Therefore, the transition team will 
also lead the development of all the 
procedure updates—typically on 
the order of 150 updates. Each 
procedure has to be revised and 
tested in an operations readiness test. 
The flight director oversees the flight 
rule modifications. 

Planning the Transition 

Once the uplink procedure has 
been developed and tested, it is ready 
for the transition. The increment 
team tries to find a time to perform 
the upgrade (see Chapter 1) while 
the testing is taking place. In an 
ideal world, the software is ready at 
a given time and the team performs 
the uplink. In the dynamic world of 
the ISS, this is rarely the case. For 
example, visiting vehicle software 
needs to be tested with the version 
of the ISS software that will be 
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operating during that vehicle’s 
mission to the ISS. However, both 
the visiting vehicle and the software 
transition schedules are often very 
dynamic. If a visiting vehicle 
mission was to overlap a software 
transition, its software would need 
to be tested with both versions of 
ISS software. Flexibility could be 
provided by testing all permutations 
of software interaction. However, 


the required testing is time 
consuming and expensive, thus a 
lot of effort is put into scheduling 
software transitions away from 
visiting vehicle and other dynamic 
operations. To date, this has not 
been anything more than a planning 
exercise. Therefore, careful 
evaluation of impacts to the software 
schedule are required when a mission 
does change its schedule. 


Several program reviews are 
scheduled as the time approaches 
to ensure everything is ready for 
the transition. As with other major 
activities, the flight director will 
brief the program management on 
the proposed changes and plan, 
with the final “go/no go” occurring 
at the ISS Mission Management 
Team level a few days before the 
planned event. Here, the program 


“EPIC or BUST” 

Don Pettit, Expedition 30 and 31 

An orbital “brain transplant” can be done with new 
software uplinked into the flight computers via radio 
waves. As in a B-grade sci-fi movie where some hapless 
creature’s brain is reprogrammed, the old system is 
replaced with the new—usually, but not always, with 
known results. This is accomplished from Mission Control. 
If the brain transplant goes as designed, the on-orbit crew 
may not even know it happened. 

Sometimes, the necessary upgrade actually requires 
new brains. This happened during my last visit to the 
space station in 2012 during Expedition 30. The central 
processing units for the main computers were being 
upgraded from the 8086/16 MHz processors that 
were launched with new Pentium 266/144 MHz chips 
(Chapter 5). These new brains, known as Enhanced 
Processor and Integrated Communication Controller, 
or EPIC, cards, were required to handle the more 
advanced software before the visiting cargo spacecraft 
could approach and berth to the United States On-orbit 
Segment—events planned for the very first time about a 
month into our mission. No pressure on us, except that 
the fate of the commercial space program hinged on our 
ability to perform this brain transplant. My commander 
Dan Burbank and I received hours of preflight training, 
prying the old computer boards from the MDM out from 
practice flight computers and replacing them with shiny 
new ones, complete with gold-plated contacts and 
conformal-coated circuits. The conformal coating is a 




Figure 2. Astronaut Don Pettit uses the oscilloscope to measure the 
EPIC cards’ timing signals. 


polymeric film that keeps aimlessly floating bits—i.e., little 
chunks of zero-gravity detritus—from shorting out the 
circuit boards. All the brain transplants were planned early 
in our mission so that the first commercial spacecraft, 
Space Exploration Technologies Corporation (SpaceX) 
Dragon D1, could pay us a visit. The new brains, all 10 
of them, were already on orbit well before my launch. We 
were all set for brain surgery. Or so we thought. 

Then we found out the new processor cards (already on 
orbit) were built at the factory with a defective component 
that would cause the internal clock timing to go bonkers, 
thus causing the computer to do the orbital equivalent of 
the “blue screen of death.” It is not good for spacecraft 
brains to go into la-la land when you are traveling at 
28,163 km/h (17,500 mph) with a commercial spacecraft 
waiting on your doorstep (Chapter 14). To complicate 
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manager, international partners, and 
operations team review the status of 
the transition to make sure everyone 
is ready to begin the process. 

Loading the New Software 

The process of loading new software 
is time consuming. Since the MDMs 
do not have CD-ROM readers, all 


the software has to be uplinked. 

The software is large—representing 
about 30 MB of data in hundreds 
of files. Since the S-band link 
with the ISS (see Chapter 13) can 
transmit about 72 kbps, it takes about 
30 hours to uplink the files to the 
computers. At the same time, the 
crew will spend a couple of hours 
configuring several of the PCS 
laptops for the new CCS software. 


Once all the software has been 
staged on board, the team executes 
the planned transition. Due to the 
need to reconfigure ISS systems, the 
transition will usually take multiple 
days with one or two MDMs being 
loaded each day. The ISS crew is 
kept informed of the progress of 
the transition, as specific versions 
of procedure may need to be run 
depending on which software version 


matters, this defective chip was estimated to be in only 
one out of the 10 circuit boards. We were playing orbital 
roulette. Only two or three spare circuit boards were in 
existence (still on Earth), and they fortunately checked 
out. These were manifested to launch with me on Soyuz. 
But how would we beat the odds of this game of orbital 
chance? The answer came from the orbital repair and 
maintenance team, passionately called Operations 
Support Office, or OSO, working closely with Honeywell, 
which had manufactured the cards. They found a small 
electronic widget that converts a laptop computer via the 
Universal Serial Bus port into a fully featured oscilloscope. 
The part was actually a Link Instruments’ MSO-19 
Oscilloscope, Logic Analyzer, Pattern Generator and 
Time Domain Reflectometer. As I said, a widget. With this 
device, it would be possible to power up the circuit boards 
on orbit and run them for a few hours where errant timing 
would become obvious. We now had a way to find the 
“bad boy.” All we had to do was stow this on my Soyuz. 

Or so we thought. 

By the time the Mission Control team had this worked out, 

I was in Baikonur, Kazakhstan, literally halfway around 
the world from Houston. And I was only days away from 
launch. To officially have this manifested and tucked 
away into some tiny nook on the Soyuz was not deemed 
possible. Some things, seemingly simple, find unbelievable 
friction when they cause a change in the matrix. 

Each crew member has an allotment of 1.5 kg (3.3 lbs) 
of personal items, little knickknacks that help remind 
them of family and friends over the 6 months they are 
orbiting Earth. These items are painstakingly weighed 


on an electronic scale with no allowance for being 
overweight. I offered some of my personal mass so that 
the oscilloscope could fly; however, the flight unit was still 
in Houston. NASA worked to expedite the transfer of the 
flight unit from Houston to Moscow and from Moscow to 
Baikonur. Within days, the flight unit arrived in my dorm 
room. I even practiced measuring the signal from the 
coffee pot in my room. Our team’s mantra for this project 
was “EPIC or BUST.” 

My personal allotment was already full, so I started pulling 
items off the scale until it reached the acceptable mark. 

My wife’s necklace, gone. My twin boys’ camping spoons, 
gone. My alma mater’s pennant, gone. Mission patches 
for family and friends, gone. The scale tipped to the good 
side and I was set to launch. 

Dan Burbank was already on orbit, having launched the 
month before. I launched on December 21,2011, the 
same day that comet Lovejoy surprised astronomers when 
it emerged from behind the sun with a brilliant tail. We 
unloaded the cards and widget the next day and started 
in on neural surgery. Dan did the surgery, replacing old 
brains for new. I set up the oscilloscope and checked out 
the circuit boards that were already on orbit. Working with 
all the folks in Mission Control, it took us a week or so 
to complete the brain transplant. This is teamwork at its 
best. Nine days later, we loaded the new software (“R11 ”) 
on the repaired computers. The new hardware, coupled 
with the new software, worked as designed. In May, I flew 
the Canada robotic arm and snagged Dragon D1, thus 
ushering in the world of commercial space. 
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is currently operating. After the 
software has been loaded, the team 
archives any products associated with 
the previous version of software and 
performs a lessons-leamed review 
to identify any improvements to the 
process for the next transition. 

Lessons Learned 

Over the years of operating the ISS, 
many of the lessons learned have 
helped craft more-efficient software 
transitions and corrected items that 
caused issues in earlier transitions. 

An early example of this came during 
the first major CCS transition. The 
operations team is responsible for 
developing certain configuration files 
for the MDMs. In this case, NASA 
developed a Load Shed Table—i.e., a 
list of commands used to deactivate 
electrical loads in off-nominal 
situations for CCS Rl. When the 
planning process started for CCS R2, 
it was determined that the commands 
listed in the Load Shed Table did 
not need to be updated at that time. 

A default Load Shed Table built by 
software developers was used during 
CCS R2 testing. 

The operations team commanded 
the incorporation of its CCS Rl 
Load Shed Table after the real-time 
transition to CCS R2. When this 
happened, the primary C&C MDM 
failed. When the backup C&C 
MDM took over, ground software 
automatically attempted to complete 
the load of the Load Shed Table, 
which caused that C&C MDM to 
fail. Luckily, the third C&C MDM 
was not configured for Tracking and 
Data Relay Satellite communications. 
When the third C&C MDM took over, 


the ISS did not have communications 
with the ground. This allowed the 
operations team to abort the attempted 
Load Shed Table uplink. 

Upon investigation of the issue, 
NASA determined that the updated 
CCS software had been recompiled, 
which had caused the memory 
address for the Load Shed Table data 
to change. The Load Shed Table 
overwrote critical software when the 
CCS Rl Load Shed Table was loaded 
to a C&C MDM that was running 
R2, thereby causing the MDM to fail. 
Although the intended content and 
function of the Load Shed Table did 
not need to be changed, the actual file 
needed to be updated to match the 
recompiled software. 

Multiple actions were taken to update 
the transition process as a result of 
this incident. First, the transition test 
procedures were updated to assure 
that the flight versions of all files 
were tested. Second, the ground 
commanding software was updated 
to abort any attempt to load a file if 
a C&C MDM transition occurred, 
thus preventing a bad uplink from 
taking down multiple MDMs. Third, 
the Load Shed Table (and similar 
files) are now being rebuilt for each 
software load, even if the intended 
function does not change. 

As occurs with visiting vehicle 
operations, spacewalks, and other 
dynamic events, the combined 
operations, engineering, and 
management teams apply lessons 
learned from software transitions 
to future plans. This improves the 
overall process of upgrading ISS 
software, which keeps the crew and 
vehicle safe and ultimately increases 
scientific output. 


Conclusion 

Despite the complexity of the space 
station, some aspects of its operations 
are familiar to the average person on 
Earth, especially when it comes to the 
need to periodically upgrade software. 
Due to the scale and critical nature 
of the software on the ISS, however, 
the planning and testing process 
takes about a year. As with any other 
system, the flight control team needs 
to adapt and respond to unexpected 
surprises that can occur, even within 
a well-orchestrated process. 
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Chapter 7 Systems: 

Motion Control 
System—Navigator 
of the Heavens 




Astronaut Dave Williams carrying one of the four massive gyroscopes used to control the orientation of the International Space Station (ISS) during 
replacement operations on STS-118/iSS-13A. 1 in August 2007. Williams (anchored in a foot restraint) is being moved along with the Control Moment 
Gyroscope (CMG) by the space station robotic arm. The CMG is being installed on External Stowage Platform-2 near the ISS airlock, where it was stored 
awaiting a return to Earth for refurbishment. 


The Motion Control System (MCS) 
keeps the International Space 
Station (ISS) “right side up” 
rotationally as well as maintains 
the ISS in the proper orbit Without 
it, the ISS would simply tumble in 
space , eventually lose altitude, and 
reenter the Earth's atmosphere . 

The MCS maintains the ISS in a 
constant attitude for day-to-day 
operations, maneuvers the ISS to 
special attitudes for visiting vehicle 
dockings and captures, and reboosts 
the ISS to counter atmospheric drag 
or avoid space debris. The system 
uses Global Positioning Satellites 


(GPSs), rate gyroscopes, and other 
sensors to allow the ISS to “know” 
its location as it circles the Earth. 
These data are also used to point 
solar arrays at the sun, antennas 
to communications satellites, and 
payloads to ground or other targets. 

The ISS MCS, as it exists today, is 
a shared responsibility between the 
US Segment and Russian Segment 
of the ISS. The core of the Russian 
Segment MCS was launched as part 
of the Russian Service Module (SM) 
on July 12, 2000. Nearly all of the 
Russian MCS, as it exists today, 
was activated when the SM was first 


launched. The thruster-based control 
system of the SM was extremely 
important for the early assembly of 
the ISS, as it was the only attitude 
control for the early portions. 

Today, the SM continues to provide 
thruster-based attitude control for 
larger maneuvers, or to assist the US 
Segment attitude control system when 
it cannot provide enough control 
force. Additionally, Progress cargo 
vehicles docked to various docking 
ports on the Russian Segment have 
thrusters that are commanded by the 
SM and augment its original thrusters. 
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The US Segment MCS was built up 
over several flights, starting with 
the United States On-orbit Segment 
(USOS) Destiny Laboratory, which 
was launched on February 10, 2001. 
The primary feature of the US 
Segment is four Control Moment 
Gryoscopes (CMGs), which can 
maintain attitude control for weeks 
at a time electrically without using 
precious rocket propellants. 

Because of its large size and 
extended lifetime, and because the 
MCS is shared between the US and 
Russian segments, the ISS has a 
number of unique features compared 
to the motion control systems of 
other satellites. These features 
include the following: 

■ The Russian Segment carries 
several tons of hypergolic propellant 
for propulsive attitude control and 
reboosts. Hypergolic propellants (in 
this case, a fuel of hydrazine and an 
oxidizer of nitrogen tetroxide) react 
and ignite on contact with each 
other. The propellant is periodically 
replenished by Progress resupply 
vehicles launched from Russia 
(typically around four per year). 

In the past, propellant was also 
resupplied by the European Space 
Agency Automated Transfer Vehicle 
(ATV). The ISS is the only satellite 
for which the on-board propellant is 
periodically replenished; for other 
satellites, the depletion of propellant 
usually marks the end of useful life. 

■ Although the SM houses a complete 
set of attitude control thrusters and 
reboost engines, it can also control 
and automatically fire thrusters and 
reboost engines on the Progress 
vehicles that are normally docked to 
the aft of the SM or on the Docking 
Compartment-1 (DC-1). 


■ Most components, including the 
flight computers in both the US 
Segment and the Russian Segment, 
the CMGs, rate gyro assemblies, 
Space Integrated Global Positioning 
System/Inertial Navigation System 
(SIGI) receivers, and antennas 
can and have been replaced 
on orbit. In many cases, failed 
components have been returned, 
serviced and refurbished, and 
relaunched for use as spares. 

As with everything else on the ISS, 
computers are at the core of the 
MCS. The work of the MCS is shared 
between the US Segment and the 
Russian Segment, extending to the 
computer systems at the center of 
the system. The MCS is built around 
a portion of the Command and 
Data Handling System, informally 
referred to as the “4-Box,” which 
includes the four-computer systems 
that manage and execute the 
motion control task. Two computers 
on the US Segment and two 
computers on the Russian Segment 
work together to control the ISS 
attitude and orbit. These computers 
process inputs from sensors such as 
GPS, star trackers, and rate sensors 


(discussed below) while commanding 
CMGs and small rockets to control 
the attitude and orbit. 

Command and Data 
Handling Elements 

The 4-Box consists of the Tier 1 
Command and Control (C&C) 
Multiplexer/DeMultiplexer (MDM) 
and Russian Segment Central 
Computer and the Tier 2 Guidance, 
Navigation and Control (GNC) 

MDM and Russian Segment Terminal 
Computer. There are three C&C 
MDMs (Primary, Backup, and 
Standby) and two GNC MDMs 
(Primary and Backup). In both sets of 
computers, the Primary is performing 
all processing while sharing 
information with its powered-on and 
“hot” backup MDM. The Russian 
Central Computer and Terminal 
Computer are actually each a set of 
three independent computers that 
provide redundancy. See Figure 1. 

The C&C MDM and Central 
Computer manage the overall 
configuration of the system (such 
as which segment is in attitude 





Command 
& Control 


Terminal ====== Guidance, 

Navigation, 
and Control 



Figure 1 . 4-Box computer architecture of MCS. 
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control), whereas the GNC MDM 
and Terminal Computer determine 
attitude and position through the use 
of sensors, and physically fly the 
ISS with CMGs and small thrusters 
under guidance from Mission Control 
Center-Houston (MCC-H), Mission 
Control Center-Moscow (MCC-M), 
and occasionally the crew. 


Vectors and How NASA 
Uses Them 

An important concept to how space 
vehicles and Mission Control know 
their location in space and the relative 
location of other objects is that of the 
vector. The simplest kind of vector is 
a location within a coordinate system 
that is defined by a grid. 




Figure 3. Vector representation in 
three dimensions. 


In Figure 2, the point O is the origin 
of the system, and the point A is a 
point of interest at x coordinate 2 and 
y coordinate 3. Vector OA describes 
the location of this point in this 
simple coordinate system. 

Figure 3 shows a slightly more 
complex system, which extends into 
three dimensions to show the location 
of point A. 

A practical example of the use of 
a vector is shown in Figure 4. A 
position vector for the ISS can be 
described using kilometers in the X, 
Y, and Z axes by setting a coordinate 
frame in the center of the Earth. 
Mathematically, this is how the 
computers on the ISS and those in 
Mission Control store knowledge of 
the ISS position. 


The following paragraphs include 
references to several types of vectors, 
but all of them essentially describe 
the position (and sometimes velocity, 
as well) of one object relative to 
another object. 

Where Is the International 
Space Station? 

Fundamentally, the MCS senses and 
controls two elements—the orbit in 
which the ISS circles the Earth, and 
the attitude that the ISS holds relative 
to Earth during that orbit. 

The ISS flies a nearly circular orbit 
inclined 51.6 degrees to the equator 
and circles the Earth once every 90 
minutes. Orbital altitude is typically 



Figure 4. ISS position vector. 
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around 410 km (255 miles) above 
the surface of the Earth, although 
the exact altitude is manipulated by 
reboosts and by small manipulations 
of the drag of the space station 
through solar array positioning (see 
Chapter 9). This manipulation of the 
orbit ensures the ISS is at the correct 
altitude and position in orbit for the 
numerous cargo and crew transfer 
vehicles that rendezvous with the 
ISS, as well as in the proper position 
to undock cargo and crew transfer 
vehicles that return to Earth. 

The ISS maintains a rotational 
position using attitude control while 
in this orbit. Unlike, for example, an 
airplane in orbital space, there is no 
naturally defined “up” or “down” on 
the space station. The ISS usually 
performs attitude control within 
a coordinate frame called Local 
Vertical, Local Horizontal (LVLH) 
(see Figure 5). In this reference 
frame, the +X axis points along the 
velocity vector in orbit, the +Z axis 
points toward the center of the Earth, 
and the +Y axis is perpendicular to 
the X-Z plane. The frame is referred 
to as a rotating coordinate frame since 
the Z axis is always pointed toward 
the center of the Earth. 

The exact attitude of the ISS within 
this frame is usually described by a 
Yaw, Pitch, and Roll (YPR) in degrees 
(Figure 6). When the ISS is precisely 
aligned with LVLH, it is at an attitude 
of Yaw=0, Pitch=0, and Roll=0—or, 
in shorthand, YPR 0,0,0. When at 
this attitude, if one were sitting atop 
the ISS, the Earth’s horizon would 
be visible in front of him or her, as if 
that person were in an airplane. If the 
person looked below, he or she would 
see the Earth. The ISS usually flies 
within a few degrees of the LVLH 



Figure 5. LVLH reference frame. Note that the reference frame rotates so that Z 
(and the bottom of the ISS) always points at the Earth. 



Figure 6. YPR attitude definitions for the ISS. 
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attitude, a typical torque equilibrium 
attitude (which is described later) 
as the space station coasts is 
YPR -4,-3,0. Some special attitudes— 
e.g., a pitch up of 90 degrees for some 
Russian vehicle undockings—are 
used for short periods of time, usually 
for a few hours, at most. 

By flying in an LVLH reference 
frame, the “bottom side” of the ISS 
faces the Earth as the space station 
travels around it. This provides some 
advantages. Scientific packages 
intended for Earth observation (such 
as cameras) can be mounted in a fixed 
position on the underside of the ISS, 
whereas communications and other 
antennas are afforded a clear view of 
space on the top. Thermal protection 
can be specifically designed for the 
Earth-facing or space-facing side 
of the ISS. One disadvantage is the 
sun will appear to be constantly in 
motion as the ISS passes beneath it; 
thus, articulating solar arrays were 
designed to track the sun and provide 
maximum power generation. 

A final feature of the ISS orbit is 
the geometry of the ISS orbit with 
respect to the sun. As the space 
station orbits, the sun rises and sets 
every orbit (16 times a day). When 
the sun is highest in the sky, it is also 
referred to noon (as on Earth)—or, 
more specifically, orbit noon, since 
noon happens once per orbit. 

A line drawn from the center of the 
Earth to the spot on the orbit where 
orbit noon occurs is called the orbit 
noon vector. A line drawn from the 
center of the Earth directly to the sun 
is called the sun vector. Both of these 
can be visualized on Figure 7. 

The sun can be almost directly 
overhead at noon or it may be well 
off to the left or right side of the orbit, 
depending on the orientation of the 



Figure 7. Definition of beta angle (P). 



Figure 8. XPOP reference frame. 
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ISS orbit. The angle between the sun 
vector and the ISS orbit noon vector, 
shown in Figure 7, is known as the 
beta angle ((3). The beta angle varies 
between +75 degrees (low to the left 
of the ISS when flying in LVLH), 

0 degrees (directly overhead), and 
-75 degrees (low to the right of 
the ISS). The exact beta angle is 
dependent on where the Earth is in 
orbit around the sun (the sun is over 
the northern hemisphere in June and 
over the southern hemisphere in 
December), and the orientation of 
the ISS orbit about the Earth (which 
shifts westward a few degrees per 
day due to the bulged center of the 
Earth). The beta angle slowly swings 
between negative and positive 
extremes over the course of several 
months, by a few degrees per day. 

The most visible effect of beta angle 
on the ISS is that of the secondary 
gimbals on the ISS solar arrays, also 
known as the beta gimbals. These 
gimbals are used to turn the arrays 
to the left or right when the sun 
is lower in the sky (see Figure 8, 
Chapter 9). 

A reference frame called 
X-Perpendicular Out of Plane 
(XPOP) was used for attitude control 
in the early parts of the ISS assembly, 
before the full complement of solar 
arrays and gimbals were installed. 

See Figure 8. 

XPOP is a reference frame that 
is the equivalent of LVLH with a 
90-degree yaw, but only at orbit noon. 
The frame stays essentially fixed in 
inertial space, meaning it doesn’t 
rotate as the ISS goes around the 
Earth, as does LVLH. XPOP was 
designed to point the ISS toward 
the sun, which was useful at higher 
beta angles when the arrays could be 
placed only in limited positions. 


How the International Space 
Station knows its Position: 
Orbit Determination 

The orbit of the ISS can be described 
by a vector consisting of six elements: 
three elements for position relative to 
the Earth (X, Y, and Z) as described 
previously and shown in Figure 4, 
and a corresponding three elements 
to describe velocity in each of those 
axes. That vector is known as a state 
vector, and is used by the ISS to know 
its location in space so that it can, for 
example, properly point antennas at 
data relay satellites and solar panels 
at the sun. The state vector is also 
used by Mission Control to know 
where to target cargo vehicles. In fact, 
if one uses personal-computer-based 
tracking software at home to track 
the location of the ISS and determine 
when the space station may be 


visible, that software is downloading 
an up-to-date ISS state vector from 
the internet. 

Once the position and velocity are 
known at a given time, mathematical 
equations can be used to calculate 
the position at a future time. This is 
accomplished through a computer 
process called propagation; however, 
the more days a state vector is 
propagated forward, the more error 
appears in the result. Because of 
this, the state vector on the ISS as 
well as on the ground needs to be 
updated with sensor-based position 
determination to correct and update 
the mathematical propagations. 

Orbit position and velocity 
determinations can be made in a 
variety of ways for the ISS. The US 
Segment has a pair of GPS receivers 
along with an array of four GPS 


Figure 9. GPS antenna, one of four. The GPS antennas were designed to be replaceable by 
spacewalking astronauts. In this image, a technician fit checks an antenna while wearing spacesuit 
gloves to verify the design. 
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Figure 10. GPS antenna array on SO truss. The rectangle traced out by the four antennas is 3 x 1.5 m (-10x5 ft). 


antennas mounted on the SO truss 
(Figures 9 and 10). These receivers 
are SIGI units, manufactured by 
Honeywell (Morristown, NJ). SIGI 
receivers are common in satellites 
today, although the ISS was the first 
to use it operationally. 

For the most part, the SIGI receivers 
determine position in the same way 
a GPS receiver determines position 
in a vehicle on Earth. The receiver 
can triangulate a position of the ISS, 
as well as compute a time error to 
the microsecond level between the 
computer clock running on the ISS 
and that on board the synchronized 
atomic clocks on the GPSs, by 


receiving coded signals from at least 
four of the 24 operational GPSs that 
orbit above the ISS. The position is 
provided to the navigation software 
within the USOS GNC MDM to 
correct the navigation filters, if 
necessary, whereas the time error is 
occasionally adjusted by MCC-H to 
slowly adjust the on-board clock of 
the ISS (see Chapter 5). 

Similar satellite navigation equipment 
is also installed in the Russian 
Segment, which determines its own 
state vector and shares it with the 
USOS GNC flight software. The 
SIGI can also determine acceleration; 
however, this is normally only used 


during reboost maneuvers due to the 
relatively infrequent maneuvers of the 
ISS, and, even then, only occasionally. 

Additionally, tracking by ground 
radar and Tracking and Data Relay 
Satellite ranging can be used to 
determine the orbit of the ISS, 
although typically these data are used 
only by the ground. In some rare 
cases, both MCC-H and MCC-M 
may command new state vectors to 
the USOS and/or Russian Segment 
software when the ground solution 
is determined to be better or when 
the satellite navigation equipment in 
either segment is offline. 
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Figure 11. Selection of GPS estimates in the USOS GNC software. 


While the position in a particular 
orbit changes rapidly (8 km/sec 
[5 miles/sec]), the orbit itself 
changes little over the course of a 
day, mostly in the form of a small 
altitude decrease on the order of 25 
to 50 m per day (82 to 164 ft per day) 
due to atmospheric drag. Because 
of this, the MCS can easily go for 
24 hours or more without a position 
measurement (also sometimes 
referred to as a “fix”) to correct its 
orbit knowledge, although it is rare to 
go more than 1 hour. 

The USOS GNC system actually 
propagates three different orbit 
positions in memory—one based 
on measurements from GPS 
(SIGI) receiver 1, one based on 
measurements from GPS receiver 2, 
and one that is calculated by the 
Russian Segment Terminal Computer 
and transmitted to the GNC MDM. 
The software performs a comparison 
of the three estimates and will vote 
out the one that does not agree with 
the other two in order to isolate 
errors in the system. Normally, the 
three estimates will agree within a 
few tens of meters, and the system 
will automatically select GPS 1 if all 
three agree. See Figure 11. 

Attitude Determination 

Attitude (rotational position) 
determination is a more complex 
problem than orbit determination. 
Sensors are needed to determine the 
attitude at specific intervals as well as 
the changes between those times. 

The US Segment also determines 
the attitude of the ISS using GPSs, 
but in a fundamentally different way 
than that in which orbital position is 
determined. The GPS antenna array 


is relatively large, and the distance 
between the antennas is fixed and 
known. The position of the antenna 
array in three-dimensional space can 
be roughly determined by the attitude 
processor within SIGI by using the 
phase difference (i.e., time delay) 
between GPS signals received by 
at least three of the four different 
antennas in the array. These fixes 
can be infrequent (i.e., more than an 
hour apart). Tracking angles from 
the USOS Ku-band communications 
antenna can also be used as a source 
of attitude information, although this 
is considered a backup to the GPS 
(see Chapter 13). 

The US Segment has a pair of 
Rate Gyro Assemblies (RGAs) 
(Figure 12) mounted in the SO truss 
to propagate attitude in between 
relatively infrequent position fixes. 
Each RGA consists of three ring laser 
gyros mounted at 90-degree angles 
to each other to sense rates about 
all three axes. Internally, the RGAs 
measure attitude changes 200 times 
per second; five times per second, 
that information is provided to the 
GNC flight software. The GNC 
flight software updates its attitude 
knowledge at the same rate using 



Figure 12. ISS RGA. 


the attitude information to calculate 
attitude error, which is used by 
the attitude control function that is 
described later. 

A complex attitude-determination filter 
in the GNC flight software combines 
the attitude fixes from GPS or the 
Ku-band antenna in concert with 
sensed rate changes and generates a 
highly accurate filtered attitude as well 
as estimates of RGA misalignment 
and gyro drift of the RGAs. With this 
information, the GNC flight software 
typically knows its attitude to 0.1 or 
0.2 degrees accuracy. 
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Figure 13. Attitude selection algorithm in the US GNC software. 


The Russian Segment independently 
determines attitude using star 
mappers and its own set of gyros. 

Star mappers mounted on the SM 
take images of the sky and compare 
the patterns made by the stars in the 
image to a catalog of the star patterns 
stored in the software. By matching 
images to the catalog, software in 
the star mapper can determine the 
orientation of the star mapper itself. 
This information is processed by the 
Russian Segment Terminal Computer 
to determine the attitude. The Russian 
Segment also uses a gyroscope in 
the SM to determine changes in 
attitude. This system allows the 
Russian Segment to determine the 
attitude of the ISS independently and 
dissimilarly from the USOS systems. 

Both segments share, compare, and 
can use the attitude information from 
each other. This sharing, combined 
with the dissimilar system designs of 
each system, provides a significant 
advantage in redundancy, since 
major failures (e.g., power failures) 
are usually localized to either the 
Russian Segment or the US Segment. 
If the US Segment loses its attitude 
or rate information, it can easily and 
automatically switch to that being 
provided by the Russian Segment. 

The Russian Segment can similarly 
use the navigation information 
computed by the US Segment. 

As shown in Figure 13, the USOS 
GNC software carries three estimates 
of attitude and three estimates of rate 
when running at full redundancy, 
including the estimate delivered by 
the Russian Segment. The software 
compares each of the three estimates 
and will vote out a single estimate 
that is in error. 


How does the 

International Space Station 
control its location? 

The ISS uses a combination of 
small rocket thrusters located on 
the SM and Progress cargo vehicles 
on the Russian Segment as well as 
non-propulsive attitude hold devices 
(i.e., CMGs) on the US Segment 
to maintain attitude. Occasionally, 
the orbit may need to be raised or 
adjusted, which is done with rocket 
engines on the aft of the SM or 
those on the aft of a docked Progress 
cargo vehicle. 

The ISS has an elegant arrangement 
where the duties of attitude control 
are shared between the US Segment 
and the Russian Segment. Computers 
to manage the systems are divided 
between the segments and share data, 
and attitude control is handed over 
between the segments cooperatively, 
depending on operational demands. 


Besides operational needs to 
position the space station (such as 
maneuvering to a docking attitude), 
the MCS counteracts small but 
significant forces (over time) from 
the low-Earth orbit environment. 
Those forces include: 

■ Aerodynamic drag, primarily due 
to the large solar arrays. Even 
though the ISS is in space, its low 
orbit actually encounters a very 
thin portion of the atmosphere 
of the Earth. Overall drag causes 
the orbit to lose energy and the 
space station to drop to a lower 
altitude, requiring periodic 
reboosts to raise the orbit. 
Unequal drag on different parts 
of the vehicle also causes attitude 
torques (or rotational, twisting 
force) that tend to push it out of 
flight attitude, which needs to be 
constantly counteracted by the 
attitude control system. 
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■ Gravity gradient forces. 
Gravitational force acts on an 
object as a proportion of square 
of the distance from the Earth. 

Parts of the space station that are 
nearer to the center of the Earth 
are attracted more than ones 
that are farther away. While on 
Earth, and for most satellites, the 
difference would be considered 
miniscule; the size of the ISS 
causes relatively significant 
gravity gradient torques in certain 
flight attitudes. Again, the attitude 
control system needs to constantly 
counter these torques to stay in 
attitude control. 

■ Other minor forces, including 
solar radiation pressure (literally, 
pressure from light). 

At any instant in time, these forces 
are absolutely miniscule—e.g., the 
drag from the rarified atmosphere 
in low-Earth orbit is 100 times less 
than the force on the human hand 
when holding a sheet of paper. Over 
time, however, even this miniscule- 
but-constant aerodynamic force will 
cause the ISS orbit to slowly drop, 
usually on the order of 25 to 50 m 
(82 to 164 ft) per day, which drives 
the need for occasional reboosts. 

These external forces will also act to 
try to push the ISS out of attitude and 
cause it to tumble; aerodynamic and 
gravity gradient forces, in particular, 
are not evenly distributed. This drives 
the need for attitude control devices. 
For the ISS, these devices are CMGs 
assisted by occasional thruster 
firings. Electrically powered CMGs 
are used for gently counteracting 
environmental forces most of the 
time, whereas propellant-consuming 


thrusters are used for maneuvering 
and desaturating the CMG system 
when required (discussed below). 

Controlling Attitude in 
Space—Control Moment 
Gyroscopes and Thrusters 

Two general categories of activities 
require attitude control. One is 
regular day-to-day operations where 
the ISS is maintaining a LVLH 
attitude and a stable platform for 
other vehicle systems and payloads. 
During these operations, only 
small adjustments are needed to be 
applied by the control system to 
counter the tiny forces introduced 
by aerodynamic drag and gravity 
gradient forces. 

The other category is special 
operations, where control of the ISS 
attitude may require rapid rotational 
maneuvering of the ISS attitude, 
use of stronger methods of attitude 
control during rendezvous operations 
of visiting vehicles, reboost 
operations, or recovery from an 
unplanned loss of attitude control. 


Two primary methods are employed 
to control the attitude of the ISS for 
these operations (Table 1). CMGs on 
the USOS MCS system perform fine 
attitude control using only electricity 
readily available from the Electrical 
Power System, and typically are fully 
in attitude control during day-to-day 
operations. Thrusters on the Russian 
MCS can be called upon to augment 
or take over attitude control from 
the CMGs during special operations. 
Although the thrusters offer more 
power, it comes at a cost of consuming 
propellant (which must be resupplied 
from Earth), increased operational 
complexity, and the potential to 
interfere with payloads dependent on a 
microgravity environment. 

The effectors of the USOS MCS 
system consist of four CMGs. The 
CMGs each consist of a 98 kg 
(216 lbs) steel flywheel, which is spun 
by an electric motor at a constant 
rate of 6600 revolutions per minute. 
The flywheel sits on two mechanical, 
lubricated spin bearings that are 
electrically driven to keep the CMG 
running at full speed. The flywheel 
and spin bearings are mounted on 


Table 1. Comparison of CMGs and Thruster Control 


Type of Control 

CMGs 

Thrusters 

Advantages 

• Use only electricity. 

• Can hold attitude tightly. 

• No potential to damage 
solar arrays. 

• Do not interfere with 
microgravity payloads. 

• More powerful, can perform 
larger maneuvers. 

• More robust (can maintain 
attitude control when CMGs 
would be overwhelmed). 

Disadvantages 

• Limited power. 

• May require augmentation 
by thrusters for larger 
maneuvers or tighter 
control. 

• Require resupply of propellant 
from Earth. 

• Can require special positioning 
of solar arrays to avoid damage. 

• Spent propellant can cause 
contamination, especially for 
windows. 

• Firing may interfere with 
microgravity payloads. 
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an electrically driven inner gimbal, 
which in turn is mounted completely 
inside an outer gimbal. Because 
of the inner/outer gimbal design, 
the spin axis of the flywheel can be 
oriented at any position within three- 
dimensional space. 

A CMG (Figure 14) is a device 
that produces torque (a rotational, 
twisting force). A torque is generated 
on the space station by electrically 
driving the inner and outer gimbals 
and pushing or “gimbaling” the 
spinning wheel. Compared to the size 
of the ISS, the torque is surprisingly 
small, usually 10 to 30 N-m (7 to 22 


ft-lbs) depending on the velocity at 
which the gimbals are being driven 
by their motors. For a comparison, if 
a person could stand at the end of the 
space station truss, he or she could 
impart the same level of torque by 
simply pushing. 

Since the environment around the ISS 
consists of external forces that are 
much less than those encountered on 
Earth, the relatively low torque output 
of the CMGs is sufficient for all 
attitude control—except when large 
maneuvers need to be performed 
quickly. The ISS uses four CMGs, 
mounted on the Z1 truss segment, that 


work together in tandem under the 
command of the US OS GNC MDM 
flight computer. 

The MCS uses the CMGs to generate 
torque and correct the attitude when 
small external rotational forces act to 
push the space station out of its flight 
attitude. Applied over time, that torque 
is stored as momentum in the CMG 
system (momentum=torque multiplied 
by time). Since the gimbals of the 
CMGs can constantly be in motion 
and are powered electrically, they 
can provide a constant, fine attitude 
control that counteracts the small 
aerodynamic and gravity gradient 



Figure 14. A CMG prior to launch. The large box mounted on the left houses the power supplies and small computer that controls the CMG. 
The CMG measures approximately 130 x 130 x 130 cm (51 x 51 x 51 in.) and weighs 272 kg (600 lbs). 
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torques. Although CMGs provide 
excellent fine attitude control, they 
have a capability limited by physics 
as the CMGs gimbal. Generally, 
their momentum axes are pointed 
in different directions (Figure 15). 

As the CMGs provide torque and 
absorb momentum, the spin axes of 
the flywheels begin to align. When 
the spin axes of the four-CMG system 
line up, the system loses control and 
is referred to as saturated (Figure 16). 
The CMG system will become 
saturated relatively quickly for any 
significant torques (e.g., a small 
air vent overboard will saturate the 
CMGs within a few minutes) and they 
are normally incapable of performing 
an attitude maneuver of more than 
about 1 degree, unless the CMG 
maneuver is specially designed. 

The number of CMGs (four) was 
determined by how much momentum 
would be required to maintain this 
fine control during normal day- 
to-day operations in momentum 
management (explained below). 

The ISS simply maintains its attitude 
during these periods as the crew lives 
and performs research in between 
events such as visiting vehicle 
arrivals and reboosts. The basic 
capability was to maintain momentum 
management control without firing 
thrusters to support microgravity 
research and conserve propellant 
over long periods of time (~30 days). 
Three CMGs were required to meet 
this minimum level of capability. 

A fourth CMG was added to 
introduce redundancy, so operations 
could continue uninterrupted in the 
event of a failure. 

In comparison, a thruster provides 
a translational force that acts as a 
torque when applied over a distance 
between the thruster itself and the 


CMGs Producing a Torque 



Figure 15. CMG system with spin axes well 
separated and able to react to external forces. 


CMGs Producing a Torque 



Figure 16. CMG system with spin axes aligned. 
This CMG system is saturated and the wheels 
need to be repositioned (this will require thruster 
firings, also known as desaturations). 

center of mass of the space station. 
Thrusters are significantly more 
powerful sources of force and torque, 
and they control the attitude of the 
ISS more coarsely than the CMGs. 
Thrusters are used to perform large 
attitude maneuvers such as those 
required to reposition the vehicle 
attitude for dockings. Thrusters are 
also used to help control vehicle 
attitude when the CMGs become 
saturated. In a process called 
desaturation, the CMG gimbals are 
moved out of alignment while the 
thrusters fire to absorb the torque 


generated. Desaturation is an 
automatic software function on the 
ISS, where the USOS GNC MDMs 
compute a “desaturation request” 

(i.e., essentially a vector with desired 
momentum correction) and hand it 
off to the Russian Segment Terminal 
Computers. While the GNC MDM 
gimbals the four-CMG system to a 
lower momentum state, the Russian 
Segment Terminal Computer 
computes and fires thrusters on the 
Service Module and/or Progress 
vehicles to react to the CMG 
desaturation event and maintain the 
attitude of the ISS. 

In some cases, the CMG system 
may not be able to maintain attitude 
control for difficult attitude control 
situations such as an overboard vent, 
a problem in the GNC MDM or 
its software, or the loss of multiple 
CMGs due to an electrical failure. 

In these cases, software in the C&C 
MDM will automatically hand over 
attitude control to the Russian 
Segment thrusters or, in limited 
scenarios, the crew may perform the 
handover manually in response to a 
warning message. 

Although thrusters are powerful 
devices, they have disadvantages. 
Most obviously, they use propellant 
that needs to be replenished, and that 
must be launched from Earth. Several 
tons of propellant must be launched 
to the ISS, annually, using Russian 
cargo vehicles. 

Another major but less-obvious 
concern is the health of the ISS 
solar arrays. The ISS solar arrays 
are lightweight and were built to 
be deployed and unfurled on orbit. 
Because of this, the arrays and the 
structure that supports them are 
quite fragile. Imagine a large version 
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Microgravity 

Probably the most well-known environment the ISS provides is one that 
is unique to space—an environment in which objects are weightless. 
Researchers can remove the variable of gravitational influence within their 
investigations. For example, on Earth, combustion is driven by convection, 
where warm air rises and cold air sinks. Crystal structures grown in the 
weightlessness of space can often be grown larger and more pure. 

Extremely sensitive experiments such as crystal growth experiments or those 
involving liquid flow may be negatively impacted by firing of the ISS thrusters, 
or even by movement of the ISS crew. For these reasons, more sensitive 
experiments may be run in racks that have vibration isolation, are usually 
planned when the USOS CMGs are in attitude control and thruster firings are 
not planned, and may be conducted at night when the crew is sleeping. 


of a model made of tissue paper 
and toothpicks. Thrusters generate 
exhaust, which can flex and fatigue 
the arrays or slowly build up on the 
panels, thereby decreasing electrical 
generation. When thrusters are fired, 
the ISS solar arrays often need to 
be parked in particular positions to 
avoid being damaged by the thrusters, 
which usually reduces the amount of 
available power. 

Finally, the firings from the thrusters 
are not conducive to a microgravity 
environment for many payloads. 
Because of this, CMGs are in attitude 
control 99% of the time, with control 
being handed to thrusters for special 
events only, or in contingency cases 
such as loss of CMG attitude control 
or unplanned CMG saturation. 

Having both CMGs and thrusters 
available and working is critical to 
maintaining attitude control. Without 
thrusters, large maneuvers could not 
be performed, the ISS stack could 
not recover from a loss of attitude 
control event, and the ISS stack could 
not be put into position to dock or 
capture a rendezvousing vehicle. 
Without CMGs available to hold 
attitude between these events, the 
thrusters on the ISS would exhaust 
their fuel supply in a few months. A 
minimum of two CMGs are required 
to perform attitude control; however, 
three CMGs are generally required 
to safely perform all attitude control 
functions. Individual CMGs can be 
replaced by a spacewalking astronaut 
with the assistance of the Space 
Station Remote Manipulator System 
(SSRMS) robotic arm. Two spare 
CMGs are carried externally on the 
ISS to replace failed gyros. 


US Segment Attitude Control 

The control system of the US 
Segment attempts to control three 
different variables: the attitude (how 
many degrees out of the desired 
attitude is the ISS located); attitude 
rate (how fast is the ISS rotating); 
and momentum (how close are the 
CMGs to saturation and therefore 
losing attitude control without 
resorting to thrusters). How much 
each of these variables, or controller 
states, are weighted by the attitude 
control software depends on how 
the software is configured. For 
example, some software controllers 
are designed to hold attitude and 
attitude rate (i.e., how quickly the 
attitude is changing, in degrees per 
second) tightly, but at the expense 
of allowing momentum to build in 
the CMGs and therefore requiring 
thruster firings. This type of controller 
is used for dockings but is unsuitable 
for attitude control of more than a few 
hours because it uses propellant. A 


non-propulsive controller is desirable 
for most attitude control—i.e., over 
99% of the time. These controllers 
take advantage of the environment in 
which the ISS flies. 

External torques, and the associated 
momentum gain in the CMG system, 
often balance out over the course of 
an orbit. For example, as the solar 
arrays rotate, they can generate a 
torque in one direction at one part of 
an orbit, and then a corresponding 
torque in the other direction in 
another part of the orbit. The torques 
are conservative (i.e., they add up to 
zero) over a full orbit, with the CMGs 
providing the mechanism to store 
momentum on one side of the orbit 
by gimballing one direction, and then 
disperse the momentum on the other 
side of the orbit by gimballing the 
opposite direction. 

The CMGs also absorb small, 
unbalanced (on average) torques 
in orbit. Over the course of many 
hours, these unbalanced torques 
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would eventually saturate the CMG 
system and require thruster firings. 

By slightly changing the attitude of 
the ISS, however, the attitude control 
software can push the momentum 
state of the CMG system lower by 
manipulating the small aerodynamic 
and gravity gradient torques acting 
on the system. This software 
control mode is called “momentum 
management.” The controller keeps 
the momentum variable at the lowest 
while loosening up on the attitude and 
attitude rate constraints. 

While in momentum management, 
the ISS attitude will gently rock 
by several degrees over the course 
of an orbit as the software works 
to push the momentum state of the 
CMGs to zero. The advantage of 
momentum management control is 
that thruster firings are never needed 
unless a significant unexpected force 
such as a vent acts on the system. 

This saves propellant and preserves 
the microgravity environment for 
many of the ISS payloads. The 
disadvantage is that the attitude 
wobbles by several degrees, which is 
unsuitable for precision alignment of 
the ISS attitude required for vehicle 
dockings. Momentum management is 
also unsuitable for rejecting thruster 
plume disturbances from nearby 
vehicles, which is why it is not used 
for visiting vehicle capture operations 
performed with the SSRMS robotic 
arm. Finally, momentum management 
only works near certain attitudes in 
which external forces are balanced. 
These attitudes are called Torque 
Equilibrium Attitudes (TEAs). The 
most typically flown TEA is one that 
is usually within a few degrees of the 
ISS LVLH (0,0,0). 


A different control logic—referred 
to as “attitude hold”—is used for 
precision attitude alignment and 
disturbance rejection, or for attitudes 
that are not at the TEA. In attitude 
hold, the CMG system maintains 
the attitude precisely (within a few 
tenths of a degree) by prioritizing 
controlling the attitude and attitude 
rate control over keeping the total 
momentum constant. This greater 
stability allows the system to reject 
strong disturbances, thus making 
attitude hold suitable for vehicle 
dockings and robotic capture 
operations. CMG momentum can 
build rapidly in this mode since 
the attitude control software does 
not attempt to optimize the ISS 
attitude to control gravity gradient 
or aerodynamic torques, and the 
stack may not be at a TEA. In these 
cases, the system may saturate in 
minutes, and would require frequent 
desaturation firings of Russian 
Segment jets. 

A variation of the attitude hold 
logic is called the USOS Thruster 
Only (USTO). In USTO, the USOS 
software bypasses the CMG system 
and commands thruster firings of 
the Russian Segment directly by 
manipulating the software logic used 
for CMG desaturation firings. 

These attitude control concepts 
are implemented in the software in 
the form of controllers, which are 
loaded by the ground as mission 
needs dictate. These three types of 
controllers map directly to the above 
attitude control concepts: 

■ Momentum management 
controllers for use during quiescent 
orbit operations. 


■ Attitude hold controllers for 
fine control. 

■ Attitude hold controllers 
(USTO logic implemented) for 
direct USOS control of Russian 
Segment thruster firings. 

Russian Segment 
Attitude Control 

The Russian Segment performs 
attitude control using thrusters 
spread throughout the Russian 
Segment. The SM contains the 
original Russian Segment thruster 
package that is still in use today. 
Additionally, Progress vehicles 
docked to the aft port of the SM and 
the Nadir port of the DC-1 docking 
compartment have thrusters that 
are usually placed under control of 
the SM, when present. Although 
no longer in use, the European 
Automated Transfer Vehicle, when 
docked to the SM aft port, was also 
controlled by the SM. 

The Progress and ATV thrusters 
are generally preferred to the SM 
thrusters because the distance 
between the thrusters and the center 
of mass of the ISS, or the moment 
arm, is large. As when using a lever, 
the longer the moment arm, the 
greater the mechanical advantage 
and the less a thruster needs to 
fire. Additionally, unlike the SM, 
the Progress and ATV are not 
permanently attached; therefore, 
they are unconstrained by lifetime 
usage limitations that affect the 
Zvezda thrusters, which have been 
in use since 2000. 
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The terminal flight computer within 
the SM performs attitude control 
with thrusters when the Russian 
Segment is in attitude control, and 
responds to requests for desaturation 
thruster firings from the US OS GNC 
MDM when the US Segment is in 
attitude control. 

Control Modes 

The US Segment and Russian 
Segment flight software jointly works 
together through the use of several 
attitude control software modes. 

The software mode depends on what 
is operationally being done and 
which segment is in attitude control. 


The most common modes are listed 
below (see also Table 2): 

■ Free Drift/Indicator—segment is 
not controlling attitude. 

■ CMG/Thruster Assist—US 
Segment controlling attitude 
with CMGs, Russian Segment 
supporting with CMG desaturation 
firings when commanded from the 
US Segment. 

■ Thrusters—Russian Segment 
controlling with thrusters. 

Typically, the configuration of the 
MCS will be CMG/Thruster Assist 
during routine orbit operations, with 
the US Segment in attitude control 
using a momentum management 


controller. The software is jointly 
reconfigured by both MCC-H and 
MCC-M to do a dynamic operation. 
The example in Table 3 illustrates 
the procedure for configuring from 
day-to-day momentum management 
to a configuration to support reboost. 
Times are referenced to time of 
reboost burn ignition, or time of 
ignition (TIG), in minutes. TIG is 
used as a countdown for reboost 
burns, which helps Mission Control 
personnel sequence out activities 
required to perform the burn. 

The US and Russian flight control 
teams jointly manage all of these 
operations by using a common set 
of flight procedures that are built 


Table 2. US Segment/Russian Segment Control Mode Combinations 


Configuration 

US Mode 

Russian Mode 

Notes 

Usage 

Free Drift 

Free Drift 

Indicator or CMG/ 
Thruster Assist 

No active attitude 
control. 

Used immediately after docking while the 
docking interface is being made rigid. 

CMG/Thruster 

Assist 

CMG/Thruster 

Assist 

CMG/Thruster 

Assist 

US Segment controlling 
attitude with CMGs. 

Momentum management for quiescent 
operations, US control for vehicle grapples 
and capture. 

Thrusters 

Free Drift 

Thrusters 

Russian Segment 
Controlling with 
Thrusters. 

Large attitude maneuvers, Russian Vehicle 
dockings, reboosts. 


Table 3. ISS Reboost Timeline 


Time 

Center 

Action 

Notes 

TIG - 40 min 

MCC-H/MCC-M 

Uplink prep commands through Tracking 

Data Relay Satellite 


TIG - 30 min 

MCC-H 

Command handover to Russian Segment 

USOS Mode = Free Drift 

Russian Mode = Thrusters 

TIG - 25 min 

MCC-M 

Command reboost sequence to start 


TIG - 20 min 


Attitude maneuver to reboost attitude 

Under Russian Segment automatic software 
control 

TIG 


Reboost ignition 

Under Russian Segment automatic control 

TIG + 10 min 

MCC-M 

Maneuver back to normal stage TEA attitude 


TIG + 20 min 

MCC-H 

Command handover from Russian Segment 

USOS Mode = CMG/Thruster Assist 

Russian Segment Mode = CMG/Thruster Assist 
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and tested together. Flight directors 
and motion control flight controllers 
at each center jointly manage, 
over voice circuits, procedures and 
authorizations for commands. 

Assembling the Motion 
Control System 

The ISS MCS has gone through 
several evolutions throughout the 
assembly sequence. Initial capability 
was provided with the launch of the 
Functional Cargo Block (FGB) with 
its basic propulsive control system 
used for attitude control from launch, 
by the addition of the Node 1 on 
Dec 6, 1998, and until arrival of the 
SM on July 26, 2000. Upon arrival of 
the SM, the FGB control system was 
permanently shut down and converted 
to propellant storage. 

During the next 7 months, the SM 
provided attitude determination 
and attitude control using thrusters, 
with orbit determination being 
done via ground-based radar. The 
US OS CMGs arrived with the Z1 
truss during Space Transportation 
System (STS)-92/ISS-3A in October, 
although the CMGs were inactive. 

The CMGs were activated and 
the first attitude control handover 
was performed to the USOS MCS 
following the arrival of the USOS 
Destiny Laboratory on February 10, 
2001, along with the necessary flight 
computers and software. The USOS 
MCS and CMGs have performed 
normal day-to-day attitude control 
since this first activation, with Russian 
thrusters engaged only every few 
weeks for larger attitude maneuvers, 
reboosts, or docking/capture of cargo 
or crew transport vehicles. 


The arrival of the last major 
assembly—the SO truss on STS-110/ 
ISS-8A in April 2002—completed 
the ISS control system. The SO 
truss mounted the two RGA attitude 
rate sensor packages and four 
GPS antennas (with the SIGI GPS 
receivers launched earlier in the 
USOS Laboratory). This upgraded 
equipment, along with a software 
update to the GNC and C&C MDMs, 
allowed the US Segment to fully 
determine attitude, attitude rate, and 
orbits independent of the Russian 
Segment, thus greatly extending the 
redundancy of the ISS MCS. 

This completed the initial system 
assembly. Although assembly 
and reconfiguration of the system 
continues in some respects, each 
Progress vehicle is used for auxiliary 
propulsive elements, primarily 
to provide reboost engines and 
augment roll control with thrusters. 
Additionally, software continues to 
be incrementally upgraded to take 
advantage of operational experience, 
such as using the Ku-band antenna to 
help determine attitude along with the 
GPS receivers. 


Control Moment 
Gyroscope Failures 

The CMGs were the subject of a 
considerable engineering and test 
effort while under development 
because of their criticality, and the 
fact these mechanical devices must 
spin at a high speed for decades. 

The first CMGs used in space were 
developed for the Skylab Program, 
which used three CMGs. During the 
relatively short Skylab operational 
mission, one CMG suffered a spin 
bearing failure and was shut down, 


and a second was near failure. The 
ISS CMGs were direct descendants of 
the 1973 Skylab CMGs. NASA made 
improvements in the bearing design 
to increase the operational lifetime. 

Despite this effort, problems with 
the CMGs continued early in the ISS 
Program. The CMGs were activated 
on February 12, 2001, during 
STS-98/ISS-5A, after being launched 
late in 2000 and stored with only 
survival heaters active on the Z1 
truss. These CMGs were responsible 
for nearly all of the ISS attitude 
control after that time. 

On June 8, 2002, controllers in 
MCC-H noticed that, after little more 
than a year of operations, CMG-1 
vibrated as it spun. Over the next 
several hours, the vibrations worsened 
until one of the two mechanical spin 
bearings failed. It took more than an 
hour for the energy in the spinning 
wheel to dissipate, at which time one 
side of the bearing assembly became 
so hot it melted the ball bearings 
inside. The crew reported a sound, 
which astronaut Carl Walz described 
as “a pretty loud, audible noise. A 
kind of growling noise in the Node.” 
The CMGs are mounted in the Z1 
truss, which in turn is mounted to 
the zenith port of the Unity Node. As 
with all key elements of the ISS, the 
CMGs can be replaced (Figure 17). 

After a great deal of concern over 
the health of the remaining three 
CMGs, especially during the stand 
down following the Space Shuttle 
Columbia accident in 2003, NASA 
replaced CMG-1 during STS-114/ 
ISS-LF1 in 2005 and returned 
the gyroscope to Earth. CMG-3 
exhibited similar issues shortly 
after CMG-1 was returned. CMG-3 
was eventually shut down and 
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Figure 17. Astronaut Dave Williams works to replace a CMG during STS-118/ISS 13A.1. 


As with the systems on orbit, flight 
controllers in both MCC-H and 
MCC-M work closely together to 
keep the complete ISS MCS in good 
health for the purpose of supporting 
a stable platform for both the crew 
and the research program. 


replaced, as well. A postmortem 
investigation indicated design issues 
within the spin bearing that caused 
the ball bearings to skid instead of 
roll, exacerbated by relatively high 
gimbal rate limits. 

The CMGs exhibited no additional 
signs of distress following software 
modifications to slow down the 
maximum rates of the gimbals from 
3 deg/s to 0.8 deg/s. Furthermore, the 
two spares stored on the ISS have an 
improved bearing design based on 
lessons learned from the failures of 
CMG-1 and CMG-3. 


Conclusion 

Although the MCS can only fully 
support the ISS by combining the 
vastly different US Segment and 
Russian Segment systems, both 
systems complement each other 
well. The USOS system provides a 
smooth microgravity attitude control 
capability that minimizes the use 
of on-board propellant consumables, 
and the Russian Segment system 
provides the necessary thruster 
capabilities to handle reboosts and 
attitude control situations beyond 
the capabilities of the CMGs. 
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Chapter 8 Day in the Life: 

Debris Avoidance- 
Navigating 
the Occasionally 
Unfriendly Skies 
of Low-Earth Orbit 




The potentially destructive nature of space debris. This photo (from a ground test) shows the damage done to a solid block of aluminum by a small 
7-g (0.2-oz) projectile traveling at 7 km/s (4.3 miles/s). 


The low-Earth orbit environment 
in which the International Space 
Station (ISS) flies is, compared to 
anything on the Earth, a very empty 
place . But it is not completely empty. 
The detritus of more than 50 years of 
human activity in space encircles the 
Earth as a cloud of orbital debris— 
a nearly invisible threat to every 
satellite in orbit, including the ISS. 

Orbital Debris—A Serious 
Threat to all Spacecraft 

Similar to the way the ocean floors 
across the globe are the final resting 
place for shipwrecks from thousands 


of years of human seafaring, the 
remnants of more than 50 years of 
human activity in space has left bits 
and pieces of hardware that continue 
to orbit the Earth. 

This debris (popularly known as 
“space junk”) consists primarily of 
dead satellites, expended stages from 
rocket launches, and fragmentation 
from collisions, explosions, or other 
breakups of these initially large 
pieces of hardware—sometimes 
decades after their mission has 
ended. The size of the junk ranges 
from multi-ton satellites and rocket 
stages to small-piece parts of 
satellites such as nuts and bolts, 
and even paint chips. 


These objects all orbit the Earth at 
up to 28,000 km/h (17,500 miles/h) 
in various orbits, meaning that any 
encounter between them and an 
operational satellite such as the ISS 
will usually be at extremely high 
velocities and would result in a 
hypervelocity-impact collision. 

The effects of a collision on a 
satellite can range from minor to 
catastrophic, depending on the 
velocity and especially the size 
of the impacting object. Many 
instances of damage have occurred 
from collisions between operational 
spacecraft and space debris. 


140 


CHAPTER 8 DAY IN THE LIFE: DEBRIS AVOIDANCE-NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT 














Figure 1. Damage to the Trailing Thermal 
Control Radiator on the P6 truss segment was 
noticed during a spacewalk in August 2016. 

For example, on Space Transportation 
System (STS)-93, a collision with 
a paint chip put a 10-mm (0.4-in.) 
crater into one of the windows of 
Space Shuttle Discovery, thus leading 
to its replacement, post mission. 

The ISS, having been in orbit since 
1998, bears the scars of many 
impacts, including a hole in the 
edge of a radiator panel on the P6 
truss segment (Figure 1), and a 
shattered portion of a solar array 
(Figure 2) that was caused by a piece 
of small debris. 

Without question, the most dramatic 
event was the collision between the 
active Iridium 33 communications 
satellite and the abandoned Kosmos 
2251 military communications 
satellite. The 950-kg (2094-lb) 
Kosmos and 560-kg (1234-lb) Iridium 
collided at 42,120 km/h (26,173 
miles/h). This collision resulted in the 
complete destruction of both satellites, 



Figure 2. Damage to space station solar array by space debris. 


and generated more than 1,000 new 
pieces of space debris that were larger 
than 10 cm (4 in.) in diameter. 

The US Department of Defense 
(DoD) actively tracks (and helps 
NASA and the ISS avoid) objects as 
small as 10 cm (4 in.) in low-Earth 
orbit. Approximately 23,000 objects 
of this size, other than a few hundred 
active satellites, are currently in orbit 
and are classified as orbital debris. 


Based on ground-based sensors, 
examination of returned satellite 
parts, and statistical methods, 
scientists believe approximately 
500,000 objects that are greater 
than 1 cm (0.4 in.) are in orbit. 

The population of objects in recent 
years has increased due to events 
such as the Iridium/Kosmos collision 
described above. 


Hypervelocity Impacts 

A hypervelocity impact releases a tremendous amount of energy for a given 
amount of mass, much more so than (for example) a bullet striking a target. 
Bullets travel on the order of 3500 km/h (2175 miles/h), and typically punch 
holes in targets. 

Relative velocities of two objects on a collision course in orbit are roughly 10 
times this much, and the collision for the bullet example would involve 100 
times as much energy. At this kind of impact velocity, the resulting release of 
energy is essentially an explosion. 
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Orbital Debris—Conjunctions 
and Relative Velocities 



Figure 3. Conjunction with an object in an elliptical orbit. The ISS travels in a circular orbit at a lower 
altitude while the debris travels in an elliptical orbit. The lower portion of the debris’ orbit can cross the 
plane of the ISS. 


Although debris comes from many 
sources, most travel at a very high 
speed relative to the ISS, due to 
orbital mechanics. This chapter will 
examine a common debris source: 
spent rockets. 

Many communications satellites 
operate at a high altitude (37,000 km 
[22,991 miles]) that causes them to 
orbit at the same rate in which the 
Earth rotates. This process is termed 
geosynchronous. As a satellite travels 
to that altitude when first launched, 
a rocket stage is often used and then 
expended with an orbit that has a high 
point of many thousands of kilometers 
and a low point of a few hundred 
kilometers above the Earth. This 
particular elongated orbit is called a 
geosynchronous transfer orbit, and an 
orbit of this shape is more generally 
called an elliptical orbit. 

Oftentimes, rocket bodies left in 
these transfer orbits later explode or 
otherwise disintegrate into debris that 
travels in roughly the same elliptical 
orbit. Over time, atmospheric drag at 
the low point of the orbit gradually 
drops the high point of the orbit 
until the debris reenters the Earth’s 
atmosphere. The process can take 
decades or even centuries, depending 
on how much drag the object creates. 

Figure 3 shows an example of a piece 
of debris that is in an elliptical orbit 
and at a different orientation than that 
of the ISS. 

In this elliptical orbit, an object 
travels quickly when closer to the 
Earth (for the transfer orbit described 
above, 35,600 km/h [22,000 miles/h]) 
and slower when far away from 
the Earth (for the transfer orbit, 

5,700 km/h [3600 miles/h]). In this 
orbit, it takes 10.5 hours for the object 
to complete an orbit of the Earth. 


In comparison, the ISS orbits in 
a nearly circular orbit of 400 km 
(249 miles) and stays at about 
400 km (249 miles) above the Earth 
as it travels. The velocity is constant 
at 28,000 km/h (17,300 miles/h), 
and it takes the ISS 90 minutes to 
go around the Earth. 

The ISS and any given piece of 
debris will probably never cross 
paths. With 23,000 large objects 
being tracked in orbit, however, the 
ISS typically has a close approach 
every few days. For the example 
shown in Figure 3, a close approach 
would involve the ISS traveling 
28,000 km/h (17,300 miles/h), and 
the debris traveling 35,000 km/h 
(22,000 miles/h) in a different 
direction, due to the angle between 
the orbits. This close approach 
is called a conjunction. A great 
deal of effort goes into assessing 
the risk from this conjunction 
and protecting the ISS from a 
catastrophic collision. 


Protecting the International 
Space Station from 
Space Debris 

The ISS has been shielded for smaller 
pieces of orbital debris (up to 1 cm 
[0.4 in.]) and is the most heavily 
shielded spacecraft ever flown. The 
shielding generally consists of a metal 
outer bumper offset from the inner 
pressure shell, which is also known 
as a Whipple Shield (see Chapter 3). 
When debris strikes the outer bumper, 
the debris vaporizes and dissipates 
the kinetic energy of the space junk, 
pitting the bumper but leaving the 
inner pressure shell intact. 

The portions of the ISS most likely to 
incur a strike are the portions that face 
forward into the direction of flight 
when traveling in the normal local 
verticaElocal horizontal attitude. For 
this reason, the shielding is the highest 
on the US Segment, which faces into 
the normal flight direction of the ISS. 
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Space junk that is marginally above 
the 1-cm (0.4-in.) capability of the 
shielding but less than the 10-cm 
(3.9-in.) threshold that can be ground 
tracked may cause a penetration of 
the ISS hull, which can result in an 
overboard leak and depressurization. 
The crew has the tools, procedures, 
and training to arrest such a leak by 
locating and placing a patch over the 
interior hull if the hole can be found 
before the ISS stack pressure drops 
too low. In the most extreme case, the 
crew can close off a leaking module 
by closing the connecting hatches 
and isolating it, which may cause the 
loss of the module but would leave 
the crew members and their escape 
vehicles safe and intact. 


Protection against larger pieces 
is done by altering the orbit to 
actively avoiding the debris, as 
described below. 

Active Orbital Debris 
Tracking from the Ground 
and from Space 

The first step in this protection is the 
tracking of debris by the US DoD 
Space Surveillance Network (SSN). 
The SSN uses radar and optical 
sensors, both on the ground and in 
space, that detect and track debris in 
orbit and build a catalog of objects 
in space along with their orbital 


characteristics. The SSN tracks and 
updates the orbital location of the 
debris as the debris changes orbit, 
due to atmospheric drag, or breaks 
apart. Figure 4 shows one space¬ 
scanning radar complex that is part 
of the SSN. 

Currently, the SSN uses 29 optical 
and radar sensors to characterize space 
debris, and makes approximately 
400,000 measurements per day. The 
sensors are divided into dedicated 
sensors (used exclusively for space 
surveillance) and contributing/ 
collateral sensors (sometimes used for 
other purposes). 

These sensors are spread around the 
Earth to better cover possible orbital 



Figure 4. Millstone/Haystack radar complex used to track orbital debris. The installation is located in Tyngsboro, Massachusetts. 
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Figure 5. Current space SSN sensor locations. Sensors are labeled by the name of the complex in which they are housed, which is sometimes (but not 
always) geographic location. 


locations. Figure 5 shows a map of 
sensors currently used to maintain the 
catalog of objects in orbit. 

These sensors fall into four categories: 

1) Phased Array Radars: Radar 

systems that rely on an 

electronically steered beam. 

■ BLE - Beale Air Force Base, 
California 

■ COD - Cape Cod Air Force 
Station, Massachusetts 

■ CAV-Cavalier Air Force 
Station, North Dakota 

■ CLR - Clear Air Force Station, 
Alaska 

■ FYL - Fylingdales Royal Air 
Force Station, North York 
Moors. England 


■ THL - Thule Air Force Base, 
Greenland 

■ EGL - Eglin Air Force Base, 
Florida 

■ SHY - Eareckson Air Station, 
Shemya Island, Alaska 

2) Mechanical Radars: Radar 

systems that rely on a 

mechanically steered dish. 

■ ASC - Ascension Royal Air 
Force Station, Ascension Island 

■ GBII - Globus II radar station, 
Vardo, Norway 

. MIT/LL - MIT/Lincoln Labs, 
Massachusetts (includes 
Millstone and Haystack 
observatories) 

■ RTS - Reagan Test Site, 
Marshall Islands 


3) Ground-based Telescopes: 

■ AMOS - Air Force Maui Optical 
and Supercomputing Site, Maui, 
Hawaii 

Installations of the Ground-based 
Electro-Optimal Deep Space 
Surveillance system: 

■ SOC - Socorro, New Mexico 

■ MAU - Maui, Hawaii 

■ DGC - Diego Garcia Island 

4) Space-based Optical: Sensors on 

satellites in Earth orbit. 

■ SBSS - Space-based Space 
Surveillance, satellite system 
operated by the US Air Force 

■ SAPH - Sapphire satellite 
system operated by the Canadian 
Armed Forces 
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Figure 6. The imaginary box (aka the pizza box) around the ISS. 


Debris Screening 

The DoD Joint Space Operations 
Center (JSpOC) at Vandenberg Air 
Force Base, California, performs an 
assessment of the orbit of the ISS 
against this catalog of debris every 
8 hours. In this assessment, the orbit 
of the ISS is projected out several 
days, along with tracked space 
debris that is orbiting such that it 
may come close to the ISS. When 
this assessment predicts a potential 
close approach between the ISS and a 
piece of space debris (usually within 
the following 72 hours), JSpOC will 
provide data on the close approach, 
including predicted miss distance 
and time of closest approach (TCA) 
to the Trajectory Operations Officer 
(TOPO) flight controller in Houston. 

The TOPO screens an imaginary box 
of space around the ISS (sometimes 
referred to as the “pizza box”) that is 
± 25 km (±15.5 miles) in the direction 
of motion, ± 25 km (±15.5 miles) 
perpendicular to the direction of 
motion, and ± 0.5 km (±0.3 miles) 
radially from the ISS as it flies in 
orbit. This is shown in Figure 6. 

If the predicted miss distance is 
within this box, the TOPO will notify 
the flight control teams in Houston 
and Moscow of a potential collision 
hazard. TOPO will use tracking data 
on the object and the position of the 
ISS (see Chapter 7) to calculate a 
probability of collision (Pc) that is a 
mathematical representation of the 
likelihood of a collision between the 
ISS and an object during the close 
approach. The computation takes 
into account variables that impact 
the known orbits of the ISS and the 
target object, such as uncertainties in 
atmospheric drag and quality of radar 
tracks on the target. Just because an 
object can be detected by radar does 


not always mean the precise location 
can be pinpointed. For example, 
depending on the size or composition 
of an object, it might be barely 
detectable, meaning the radar may 
get glimpses of an object but not a 
clear view. The TOPO continuously 
refines the Pc of the object as the 
TCA approaches, iterating up to 
several times per shift, depending 
on the level of concern regarding the 
potential collision. 

JSpOC will also work with TOPO 
and the SSN on increasing coverage 
on a problem space object to better 
understand its orbit as required, 
especially if it becomes a threat to the 
ISS. Coverage can be increased by 
using more radars and/or telescopes 
to gather more data on the object. 
Coverage can be increased by 
tracking an object multiple times per 
day as it passes over various tracking 
sites when ordinarily it may only be 
tracked once every few days. 


Evaluating the Risk of a 
Potential Collision 

Flight rules define four levels of 
concern and actions for orbital debris 
that will have a close approach and 
has a calculated Pc: 

■ Green: Pc less than 10' 5 (less than 

1 in 100,000 chance of collision)— 
no action required. 

■ Yellow: Pc between 10' 5 and 10' 4 
(Pc greater than 1 in 100,000 but 
less than 1 in 10,000)—a debris 
avoidance maneuver (DAM) 
should be attempted prior to TCA 
unless there is a major impact to 
the ISS operations (such as loss of 
a rendezvous opportunity with a 
cargo vehicle). 

■ Red: Pc between than 10' 4 (Pc 
greater than 1 in 10,000) and 10' 2 
(1 in 100)—a DAM should be 
performed prior to TCA unless the 
burn itself will place the crew at 
greater risk. DAMs may also not be 
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performed during the short 4-orbit 
rendezvous of Soyuz and Progress, 
the last 30 hours of the longer 
Soyuz 34-orbit rendezvous, or the 
final proximity operations of the 
Progress 34-orbit rendezvous. This 
is to protect for cases where the 
DAM would potentially prevent the 
rendezvous of the visiting Soyuz/ 
Progress to the ISS. 

■ Black: Pc greater than 10' 2 (Pc 
greater than 1 in 100). A DAM 
must be performed prior to TCA 
unless the burn is in the final 
minutes of a Soyuz or Progress 
docking operation. This is a brief 
window of exposure. 

The action levels provide a good 
example of risk management as it 
appears in flight rules. On a green 
conjunction, the risk is not zero. 
Rather, it is reasonably small— 

1 in 100,000 chance of impact. 

Although the risk of collision could 
be driven closer to zero by moving 
the green line to, for example, a 1 in 
1,000,000 chance, it would also mean 
the ISS would need to perform far 
more debris avoidance bums, perhaps 
even weekly. 

Burns of this frequency would be 
unsupportable. Research on the 
ISS would be impacted, propellant 
would be depleted, and the orbit 
would change so often that some 
cargo missions would need to be 
delayed. The threshold chosen 
represents a balanced and accepted 
risk where it is as low as possible 
while still allowing the ISS to be 
useful as an orbiting laboratory. 

The yellow—and especially the red 
and black—thresholds, however, 
represent unacceptable risk to the 
crew and ISS, and are where the 
space station will actively move out 
of the way of debris. 


In the best circumstances, the 
conjunction is with a well-tracked 
object and the TOPO will have several 
days prior to the TCA to calculate 
multiple updates to the object, refine 
the Pc, and trend the conjunction. 
Sometimes, however, an object may 
be more difficult to predict. For 
example, a large flat piece of metal 
from an expended rocket stage in a 
low orbit has high atmospheric drag 
in one orientation, and low drag in 
another. Since it may be tumbling, the 
drag slowing it down and changing 
its orbit could vary and makes the 
TOPO’s job more difficult. This is the 
sort of situation in which additional 
tracking can help. 

As the conjunction nears, the Pc 
typically gets greener (as described 
in the next section) with additional 
tracking and less uncertainty because 
the orbit of the object becomes better 
understood and less time will elapse 
(and introduce prediction error) 
before the conjunction. For this 
reason, and because the maneuver 
can be dismptive to ongoing ISS 
operations, the general philosophy is 
to delay a DAM as long as possible 
to provide the TOPO the opportunity 
and data to ensure the necessity of 
that maneuver. In the end, it often 
comes down to the flight director 
making the best decision possible by 


balancing the impacts and risks per 
the flight mle, based on the available 
data and expertise of the TOPO. 

Tracking and Evaluating 

Figure 7 shows the trend of a piece 
of debris (in this case, part of an 
exploded rocket upper stage) in 2013. 
The format of the table is exactly the 
same as that used by the TOPO as he 
or she works with the SSN to refine 
the Pc over time. 

In the Figure 7 example, data were 
first provided to MCC-H as an 
Orbital Conjunction Message 
(OCM) 68 hours prior to the TCA. 
Additional OCMs were provided 
every 4 to 6 hours as JSpOC, the 
TOPO, and the flight director 
continued to evaluate the risk posed 
by the object to the ISS. 

The first four OCMs do not include 
a Pc since several computations 
over time are required to generate 
an official Pc to collect data and 
provide an accurate assessment of 
the collision risk. As can be seen 
by examining the miss distances in 
early OCMs (1-4), the miss distances 
are changing relatively significantly 
due to uncertainty in the position 
of the object. 


Collision Avoidance History 

NASA first implemented conjunction assessment on STS-26 in 1988 by 
using a simple 4 x 10 x 4 km (2.5 x 6.2 x 2.5 mile) football-shaped volume as 
a “keep out” zone around the Space Shuttle based on simple miss distance, 
which worked well for the relatively maneuverable shuttle. 

Prior to the ISS first element launch in 1998, NASA and the DoD 
implemented the higher-fidelity risk-based assessment to better understand 
when a burn was required and to avoid the operational and science impact 
of performing an unnecessary DAM. 
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OCM# 

TCA (hours) 

U (Radial) 
(km/miles) 

V (Downtrack) 
(km/miles) 

W (Cross track) 
(km/miles) 

R (Spacing) 
(km/miles) 

Pc 

1 

68.9 

1.06/0.66 

45.90/24.46 

-11.41/-7.07 

47.31/29.33 


2 

62.6 

1.02/0.63 

43.70/27.09 

-10.86/-6.73 

45.04/27.92 


3 

58.3 

-0.57/-0.35 

-12.60/-7.81 

3.10/1.92 

12.99/8.05 


4 

54.8 

-0.22/-0.14 

-1.05/-0.65 

0.24/0.15 

1.10/0.68 


5 

49.8 

0.93/0.58 

44.48/27.58 

-11.07/-6.86 

45.85/28.43 

2.1x10 5 

6 

46.4 

1.47/0.91 

70.57/43.75 

-17.55/-10.88 

72.74/45.10 

1.6x10' 5 

7 

42.0 

2.73/1.70 

203.32/126.06 

-50.56/-31.34 

209.53/129.91 

0.0x10° 

8 

38.6 

2.73/1.70 

210.20/130.32 

-52.25/-32.40 

216.52/134.24 

0.0x10° 

9 

34.6 

2.25/1.40 

272.34/168.85 

-67.78/-42.02 

280.66/174.01 

0.0x10° 


Figure 7. Tracking of a sample conjunction. The information is arranged as follows: 

Column 1: Orbital Conjunction Message (OCM) number. The OCM is the official message from JSpOC to Mission Control Center-Houston (MCC-H) on an 
impending potential collision. Multiple messages are generally received on a particular object over time, and are represented by individual rows. In this case, 
nine messages were received before the object was cleared. 

Column 2: Time remaining until TCA: The number of hours until the TCA between a tracked object and the ISS. 

Columns 3-5: Predicted miss distance between the object and the ISS, broken out by axes described in Figure 6. 

Column 6: Predicted overall miss distance between the object and the ISS. 

Column 7: Official Pc at the time the message was generated (color coded based on thresholds set in flight rules), as computed by the TOPO in MCC-H. 


During this time period, the TOPO 
and JSpOC often work together to 
devote more observation time and 
assets of the network to help refine 
the understanding of the location 
and velocity of the object as it orbits 
the Earth, which is reflected in the 
later OCMs. 

When an official Pc was determined, 
it was for a yellow conjunction at 
49.5 hours before TCA on OCM 5. 


Yellow conjunctions can eventually 
result in a DAM if an object stays 
yellow closer to TCA; however, 
in general, additional tracking and 
reduction in uncertainty often clears 
an object. In this case, the Pc was 
calculated as zero and the object went 
green 42 hours prior to TCA. 

Unfortunately, some conjunctions 
stay yellow or become red as more 
tracking becomes available. Debris 


that has high atmospheric drag or is 
in an unusual orbit (such as a highly 
elliptical orbit) is less predictable, 
and some collision threats are not 
identified until late (less than a day 
before TCA). Figure 8 shows a 
conjunction that began as green and 
eventually developed into enough of a 
threat to require a DAM. 

In these cases, a DAM is planned and, 
if necessary, executed. 


OCM# 

TCA (hours) 

U (Radial) 
(km/miles) 

V (Downtrack) 
(km/miles) 

W (Cross track) 
(km/miles) 

R (Spacing) 
(km/miles) 

Pc 

1 

69.3 

-0.19/-0.12 

-7.26/-4.51 

-9.93/-6.17 

12.30/7.64 

2.610" 9 

2 

60.9 

-0.18/-0.11 

-11.28/-7.10 

-15.41/-9.58 

19.09/11.86 

7.51 O' 7 

3 

53.1 

-0.18/-0.11 

-2.55/-1.58 

-3.48/-2.16 

4.32/2.68 

1.41 O' 6 

4 

45.3 

-0.22/-0.14 

-1.33/-0.83 

-1.82/-1.13 

2.26/1.40 

5.51 O' 13 

5 

37.5 

-0.32/-0.20 

6.68/4.15 

9.13/5.78 

11.32/7.03 

7.0x1 O’ 17 

6 

29.0 

-0.14/-0.09 

2.95/1.83 

4.04/2.51 

5.00/3.11 

6.3x1 O' 5 

7 

21.4 

-0.07/-0.04 

-0.72/-0.45 

-0.98/-0.61 

1.22/0.76 

1.1x10"° 

8 

12.8 

-0.16/-0.10 

2.30/1.43 

3.15/1.96 

3.90/2.42 

7.6x1 O' 5 

9 

11.4 

-0.09/-0.06 

-0.88/-0.55 

-1.19/-0.74 

1.48/0.92 

2.5x10 3 

10 

9.8 

-0.04/-0.03 

-0.04/-0.03 

-0.05/-0.03 

0.08/0.05 

1.31 O' 2 

11 

5.1 

-0.01/-0.01 

-0.66/-0.41 

-0.91/-0.66 

1.12/0.70 

1.71 O' 2 


Figure 8. Development of a conjunction, which requires a maneuver. See Figure 7 for data definitions. 
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Debris Avoidance Maneuvers 

DAMs are planned as a small orbital¬ 
raising (or reboost) maneuver. 

A reboost maneuver uses the small 
rocket thrusters on the aft of the ISS 
to push it slightly higher in orbit. 

The ISS is designed such that all 
propulsion is done by the Russian 
Segment. The core of the propulsion 
system is the Service Module, which 
is operationally controlled by Mission 
Control Center-Moscow (MCC-M). 
Small thrusters on the Progress 
resupply vehicles can be used for 
both reboost and attitude control, 
depending on the specific docking 
ports, whereas the propulsion system 
is under the control of MCC-M, the 
Service Module, and the Service 
Module computers. 

Although MCC-M actually controls 
and fires the rockets, MCC-H 
provides threat assessments based 
on JSpOC data. The control centers 
work together to keep the ISS in the 
correct orbit. 

Reboost maneuvers are already 
periodically scheduled to raise 
the orbit of the ISS, which decays 
naturally due to atmospheric drag. 

A DAM is the same thing, but is 
planned with flexibility in mind so the 
maneuvers can be executed in only a 
few hours, if necessary. 

DAM reboosts are relatively small. 

A DAM performed in 2012 fired 
the Service Module engines for 
54 seconds, which raised the 
altitude of the ISS by 1.5 km 
(0.9 miles). This “nudge” in the 
orbit is all that is required to clear 
a conjunction successfully and 
carry the ISS away from the future 


potential impact. These nudges are 
usually targeted to occur 2 hours 
and 20 minutes prior to a potential 
impact, which provides sufficient 
time in the new orbit to travel away 
from the point of collision before the 
close approach occurs. 

When the need to at least plan for 
a debris avoidance bum becomes 
apparent (typically -30 hours before 
TCA for a conjunction that is not 
improving), the TOPO along with his 
or her counterparts at MCC-M will 
plan a DAM burn. The bum will be 
optimized to minimize the impact 
on the ISS operations (for example, 
if possible, to avoid periods where 
feathering the solar arrays and a 
power down would present a power 
challenge), to minimize impact to 
downstream planning of vehicles that 
will be docking to the space station 
or returning to Earth from the ISS 
in the coming months, and finally to 
place the ISS on a new trajectory that 
has been preemptively evaluated by 
JSpOC as clear and free of debris (at 
least for the next several days). 

Detailed execution planning is handed 
to MCC-M as soon as the TOPO 
has designed a DAM consisting of 
a specific burn magnitude, duration, 
and time. Engineers at MCC-M will 
build a software script that allows 
the computers in the Service Module 
to physically execute the burn. This 
script is referred to by its Russian 
moniker: cyclogram. 

The Russian software executes 
a series of cyclogram-defined 
commands on the Russian Segment 
automatically. Russian flight 
controllers at MCC-M will build 
the cyclogram on the ground, verify 
by mnning it on a software test bed 


with the same computers used on the 
space station, and uploading it for 
use on the actual reboost. It takes a 
day to complete this process if the 
cyclogram is being built from scratch. 

The cyclogram contains detailed 
commands that begin execution 
approximately 90 minutes prior to a 
debris avoidance burn, immediately 
after attitude control is handed over 
from the US Segment to the Russian 
Segment. The cyclogram will then 
configure the propulsion system to 
fire thrusters, maneuver the ISS to 
the reboost attitude (i.e., aim the 
main engines so that the thrust will 
increase the orbital altitude), and fire 
the engines at the appropriate time 
and for the appropriate duration. 

After the burn ends, flight controllers 
at MCC-M and MCC-H will work 
together to hand attitude control 
back over to its normal long-term 
configuration using the US Segment 
Control Moment Gyroscopes (CMGs). 

There are two kinds of DAMs— 
a standard DAM and a predetermined 
DAM (PDAM)—each with its 
own cyclogram. 

A standard DAM is essentially 
identical to a planned reboost except 
that MCC-H builds the software load 
on an expedited schedule. Normal 
reboosts to counter atmospheric drag 
or to set up phasing for a visiting 
vehicle are calculated months in 
advance. A standard DAM requires 
approximately 24 hours to build and 
verify, but it has greater flexibility for 
selecting burn duration and choosing 
the vehicle that will conduct the 
reboost. For example, the Service 
Module itself can perform a reboost 
if a Progress is not docked to the aft 
of the Service Module or Docking 
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Compartment-1 on the bottom of 
the ISS (which requires an attitude 
maneuver to point the Progress 
engines in the correct direction). 

A standard DAM also allows MCC-M 
and MCC-H to custom pick the burn 
duration to change the orbit velocity 
(also referred to as the delta-V). This 
can be helpful when shaping the orbit 
to account for where the ISS needs 
to rendezvous, and to undock cargo 
and crew delivery vehicles that are 
planned over the next few months. 

A PDAM is a “canned” burn plan 
with limited delta V options that 
is always ready and loaded in the 
Russian Segment. The PDAM is 
a capability that was first made 
available in 2012. Prior to that time, 
all DAMs were standard DAMs. The 
PDAM was developed in response to 
the increasing number of conjunctions 
that were occurring (due to the 
increase of orbital debris over the past 
decade) as well as the development 
time required for the standard DAM. 
Prior to the development of the 
PDAM capability, if a conjunction 
was detected between the ISS and a 
piece of debris within approximately 
24 hours, there was insufficient time 
to develop a cyclogram and maneuver 
the ISS out of the way. The crew and 
flight control team were left with 
simply isolating the crew members 
in their Soyuz vehicles as protection 
from the effects of an impact. 

PD AMs are pre-developed plans that 
permanently reside in the Service 
Module software and have bums 
available of 0.3, 0.5, 0.7, or 1.0 m/s 
(1.0, 1.6, 2.3 or 3.3 ft/s). MCC-H and 
MCC-M can select a burn magnitude 
that will best change the orbit to 
avoid a conjunction as well as keep 


the ISS in the proper position for 
later operations, such as rendezvous 
of crew and cargo vehicles that are 
weeks or months away. It is also 
possible that one bum magnitude 
may clear the ISS out of the path of 
the original debris, only to find it in 
the path of some other object. Having 
four options ensures that one solution 
can be found that will clear the path 
of all debris. 

Because a PDAM is already built 
and on board the space station 
computers, a PDAM can be 
planned and executed with as few 
as 5.5 hours remaining until a 
conjunction will occur. The 5.5-hour 
minimum is driven by the time 
required to configure the solar arrays 
(3 hours) prior to the avoidance 
bum, which is typically done 2 hours 
and 20 minutes prior to the closest 
approach. The solar arrays need to 
be positioned in specific orientations 
to avoid being stmck by the exhaust 
of the thmsters that are used for both 
the reboost and the attitude control. 
The 2-hour-and-20-minute bum 
point is driven by the need to travel 
for a short period of time in the new, 
slightly adjusted orbit to move away 
from the conjunction. 

Because the PDAM can be executed 
rapidly and cancelled late, and 
because most conjunctions become 
green as the time before closest 
approach decreases, the preferred 
strategy for debris avoidance is 
usually to wait out the conjunction 
and plan to do a PDAM at the latest 
possible time, if it is still required. 

The only downside to this strategy is 
that the burn magnitudes are limited 
to those in the canned burns. In some 
cases, MCC-H and MCC-M may 


elect to plan for a standard burn if 
a more tailored reboost would be 
beneficial from a trajectory point 
of view to preserve, for example, a 
particular rendezvous opportunity 
several weeks away. 

Predetermined Debris 
Avoidance Maneuver 
Execution 

When a space debris threat continues 
to be yellow or red with less than 
24 hours remaining to TCA, or when 
JSpOC notifies MCC-H of a late- 
notice conjunction, PDAM planning 
goes into high gear to prepare the 
ISS for an escape maneuver. As 
previously discussed, the TOPO will 
select a candidate bum time (usually 
2 hours and 20 minutes prior to 
TCA), and the MCC-H flight director 
will approve the time and direct 
teams to plan for a burn. 

This planning will attempt to 
configure the space station systems 
(especially power and payload) as 
gracefully as possible based on how 
much time is available before the 
burn executes. Most of this planning 
centers around power availability, 
since (as in many thmster firings) the 
solar arrays are repositioned to best 
protect them from thmster firings 
rather than optimized for power 
generation. Generally, this means less 
power is available than had originally 
been planned and certain systems 
need to be turned off. With careful 
planning, certain allowances can be 
made—for example, an experiment 
that requires a few more hours to 
finish will be allowed to complete 
before being turned off. The more 
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advanced warning available, the 
more time flight controllers have 
to work the intricate details of this 
power-down plan. 

When necessary, however, the 
ISS can execute a burn with as little 
as 3 hours’ notice (about 5 hours 


and 20 minutes before the 
conjunction if the burn is done at 
the standard 2 hours and 20 minutes). 
An emergency unplanned power 
down is normally required in order 
to perform a burn this quickly. This 
power down is a preplanned power 


down, which is always available 
but unrefined, and may result in 
noncritical systems being powered 
down rapidly, thus potentially 
impacting research on board. For this 
reason, the emergency power down is 
an option of last resort. 


Time 

Event 

Comments 

Pre-burn 

Request additional Tracking and 

Data Relay Satellite (TDRS) time 
from space network 

If necessary, MCC-H will request to fill gaps in TDRS satellite coverage 
of the ISS to provide command and telemetry links during critical periods 
leading up to the PDAM burn as well as the burn itself. 

TDRS satellite coverage is usually quite good, but there are often 10- to 
30-minute gaps in coverage while the satellite network is shared with other 
users. These gaps can often be negotiated with other users and filled to 
provide more time for MCC-H and MCC-M to command configurations in 
preparation for the reboost. 

Pre-burn 

Safe payload racks and other 
vehicle systems 

Certain payload and vehicle systems are sensitive to thruster firings (for 
example, the treadmill needs to be fixed to the ISS structure and not in use 
during reboost burns). 

TIG-2:40 

ISS power down 

Power down the ISS systems to support the feathering of solar arrays. 

TIG-2:40 

Generate burn options 

If not already done, TOPO generates burn options and supply to JSpOC for 
debris screening and provides options to MCC-M. 

TIG-2:25 

Power up redundant navigation 
equipment 

MCC-H powers up redundant rate gyro assemblies and enables US 

Segment accelerometers to support burn. 

Redundant gyros are brought up to protect against failures during the 
burn (in some cases, the burn may stop without the redundant equipment). 
The accelerometers in the US Segment are used by the Russian Segment 
to calculate the end of the burn. 

TIG-2:25 

Park and lock solar array joints 

Position solar arrays for propulsive support and reboost. Solar arrays are 
usually positioned in a way that minimizes the structural effects caused by 
thruster firings. 

TIG-1:30 

Select final burn option 

If not already done, TOPO selects and approves the final burn time based 
on JSpOC screening and provides the final burn option to MCC-M. 

TIG -1:30 

Final go/no go for PDAM 

The MCC-H and MCC-M flight directors authorize execution of the debris 
avoidance burn. 

TIG-1:20 

MCC-H commanded handover 
of attitude control to the Russian 
Segment 

MCC-H commands attitude control to handover from United States On- 
orbit Segment (USOS) non-propulsive CMG attitude control to Russian 
Segment thrusters attitude control. 

TIG-1:00 

MCC-M commands burn execution 
sequence initialization 

MCC-M will issue a command to begin the automatic burn sequence. 

This sequence will configure systems on the Russian Segment (including 
the propulsion and attitude control systems), maneuver the stack to burn 
attitude, and then execute the burn exactly 1 hour after the command is 
received. 

TIG 

Burn execution 

Under Russian Segment Service Module automatic control, several minutes 
in duration depending on configuration of propulsion system and engines 
used. The ISS is maneuvered back to attitude post burn. 

TIG + 00:40 

MCC-H commanded handover back 
to the USOS 

MCC-H commands attitude control back to USOS non-propulsive CMG 
attitude control. 

Post-burn 

Clean up 

MCC-H places solar arrays back in solar auto track to maximize power 
generation and repowers systems to restore normal operations. 


150 


CHAPTER 8 


DAY IN THE LIFE: DEBRIS AVOIDANCE-NAVIGATING THE OCCASIONALLY UNFRIENDLY SKIES OF LOW-EARTH ORBIT 



















The following timeline is based on 
the time of ignition (TIG)—the time 
at which the PD AM burn would 
execute. Throughout the PD AM 
planning and execution process, 
TOPO continues to refine the Pc 
calculation as data from JSpOC 
become available. If an object 
manages to go green very late, the 
bum can be cancelled. Typically, 
this occurs before the final attitude 
control handover to avoid thmster 
firings, which may perturb the 
orbit (and potentially increase the 
probability of collision). 

Safe Haven 

If MCC-H is notified of a 
conjunction very late, there may not 
be enough time to execute a burn. 

As mentioned previously, MCC-H 
and MCC-M must be notified no 
later than 5.5 hours before the TCA 
to configure the systems (primarily 
solar arrays), start the burn sequence 
on board the Russian Segment, and 
actually perform the burn. 

If insufficient time is available, 

“safe haven” procedures allow 
the ISS crew members to close 
hatches in the USOS, enter their 
respective Soyuz vehicles (which 
are used to transport crews to 
and from the ISS), and close the 
hatches in the Soyuz to be best 
set up for withstanding an impact 
and performing an emergency 
departure and deorbit, if required. 
Keeping hatches closed ensures 
that if a module is penetrated by 
an impact event, the loss of air is 
limited to that module and not the 
entire ISS volume. Keeping the 


crew members inside the Soyuz 
minimizes their exposure to an 
ISS depressurization that results 
from impact and has them pre¬ 
positioned in the vehicle that can 
return them home if the ISS is 
significantly damaged. 

Safe haven was executed on 
several occasions earlier in the 
life of the ISS before the advent 
of PDAM, when only the nominal 
DAM was available and required 
a 24-hour notice. PDAM was 
developed specifically to avoid 
the safe haven scenario and has 
been largely successful, since 
notification of a conjunction by 
JSpOC with less than 6 hours 
remaining is extremely unusual. 


Frequency of the 
International Space Station 
Debris Avoidance Maneuvers 

As of mid-2016, DAMs have been 
attempted 21 times (the first one in 
1999 was unsuccessful and did not 
burn). Further safe haven events 
(in 2009, 2011, 2012, and 2015) have 
taken place, three of which occurred 
prior to the creation of the PDAM in 
2012, which made them less likely. 
For comparison’s sake, in 2015, 

116 conjunctions fell within the 
pizza box. MCC-H actively worked 
these conjunctions, 111 of which 
eventually went green and did not 
require a DAM or PDAM. An actual 
impact with a tracked object, which 
would result in (at a minimum) 
significant damage to the ISS, has 
never occurred. Figure 9 shows the 
number of DAMs. 


Year 

# DAM 

2017 

0 

2016 

0 

2015 

4 

2014 

5 

2013 

0 

2012 

3 

2011 

2 

2010 

1 

2009 

2 

2008 

1 

2004-2007 

0 

2003 

1 

2002 

1 

2001 

2 

2000 

1 

1999 

2 

1998 

0 


Figure 9. DAMs by year through mid-2017. 


The Orbital Debris 
Environment— 

A Growing Problem 

The debris environment in the 
vicinity of the ISS has gotten worse 
over the past 15 years. According 
to the NASA Orbital Debris Office, 
more than one-third of the debris 
currently in orbit came from two 
events: the hypervelocity collision 
between the operational Iridium 33 
satellite and the abandoned Kosmos 
2251 satellite in 2009, recounted 
above; and, the intentional destruction 
of the Fengyun-lC weather satellite 
by China in 2007 with a missile 
during a defense test. The collision 
between Kosmos and Iridium alone 
produced more than 2000 pieces of 
trackable debris. 
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A Close Call 

Captain Daniel C. Burbank, Expedition 30 

Orbital debris penetrating the hull of our spacecraft 
is one of the “Big 3” threats that astronauts and flight 
directors worry about the most—along with fire and a 
toxic atmosphere. Orbital debris is a particularly insidious 
threat because there are hundreds of thousands of 
chunks of debris traveling around the Earth at enormous 
velocity, and most are too small to track with radar. 
Because of this, we essentially fly spacecraft in low-Earth 
orbit—in what pilots might euphemistically refer to as 
the “big sky, little airplane” theory of operation—where 
the likelihood of running into something is statistically 
extremely low. The difference between flying airplanes 
and flying spaceships is that things move MUCH faster in 
space than they do in the air, meaning the kinetic energy 
is exponentially higher. Something traveling in low- 
Earth orbit at a typical 28,000 km/hr (17,500 miles/hr) 
might travel at 100 times the speed of an airplane flying 
at 282 km/hr (175 miles/hr), but its energy (per given 
kilogram of mass) is 10,000 times greater. Although the 


odds are low that we will hit anything, the consequences 
of doing so are therefore potentially catastrophic. 

The call came up from Houston late in the evening 
on Friday, March 23, 2012, that JSpOC was tracking 
a late-notice conjunction —space jargon for a short- 
notice potential impact from orbital debris. The TCA 
was early the next morning. This hunk of debris was left 
over from a 2009 collision between an out-of-service 
Russian Kosmos satellite and an Iridium communication 
satellite. It was “draggy” (not very dense), thereby 
making its trajectory difficult to predict and track, 
which further limited the prediction accuracy. The way 
conjunctions usually work is that they are identified 
well in advance and, even if they start out red (high risk 
and/or high uncertainty), they gradually become yellow 
(moderate risk) and then green (essentially no risk) as the 
trajectories are refined. Even when they don’t turn green, 
the ground usually has plenty of time to plan an ISS or 
Progress engine burn, called a DAM, and nudge the 
space station away from the impending impact (this was 
before the Russian and American programs were able to 
implement the quicker PDAM process). In this case, the 
uncertainty stayed high and the exceptionally late notice 


Much of the debris from these events 
is actually above the altitude of the 
ISS. Figure 10 shows the density 
(number) of tracked objects present in 
a cubic kilometer of space at a given 
altitude. As is shown in Figure 10, 
the highest density of debris is at 
approximately 800 km (500 miles) 
altitude, and was the result of the 
Iridium and Fengyun events. 

Although the bulk of this debris is 
above the ISS orbit, it will descend 
over time due to atmospheric drag, 
and the number of conjunctions with 
the space station will increase. For 
these reasons, the flight control team 
continues to refine its tools available 
to assess and protect against threats 
from orbital debris. 



200 400 600 800 1 000 1200 1400 1600 1800 2000 


Altitude (km) 


Figure 10. Low-Earth orbit debris density (from http://www.unoosa.org/pdf/pres/stsc2011Aech-31.pdf, 
NASA report). The y-axis displays the density of objects in terms of number of objects per cubic kilometer 
while the x-axis shows the altitude. The collision between the Iridium and Cosmos satellite lead to a peak 
of about 5.5x10-8 particles per cubic kilometer at an altitude around 800 km (500 miles). 
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of the conjunction meant it would have been impossible 
to push the ISS out of harm’s way. This has happened 
only four times during 18-year lifetime of the ISS. 

So, in this case, Houston gave us the order early 
morning Saturday to configure the ISS for possible 
impact and subsequent abandonment. We were told 
to power down all the nonessential equipment, close 
the hatches between the various modules, shut down 
the intramodule ventilation, and then take shelter in our 
respective Soyuz spacecraft. The TCA was 6:38 a.m. 
The ground uplinked a “late-notice conjunction/safe 
haven actions” procedure that would guide us through 
the power downs and module isolation and tuck us 
safely away in our Soyuz spacecraft, ready to abandon 
ship, if necessary. This was an all-hands-on-deck effort 
where all six of the ISS crew members worked in tight 
coordination with the MCC flight controllers to safe 
the ISS. By closing the hatches between the modules, 
we gave the crews and MCCs a fighting chance of 
recovering the ISS by isolating any breached modules 
from the rest of the ISS volume. Compartmentalization 
is how the sailors and submariners refer to this, where 
damage to one portion of a ship is prevented from 


threatening other portions by keeping water-tight 
hatches secured. In our case, we weren’t worried about 
water coming in, but rather air going out. 

By 5:00 a.m., we started working the isolation/safe 
haven procedures beginning at the forward-most part of 
the ISS, carefully working our way aft toward the Soyuz 
spacecraft. One of the last things we did before entering 
our respective spacecraft and closing the hatches was to 
configure the ISS communication system for emergency 
mode, which would enable communication between the 
ground and the two Soyuz spacecraft. By 6:00 a.m., 
Anton [Shkaplerov], Anatoly [Ivanishin], and I were in 
our Soyuz and Don [Pettit], Andre [Kuipers], and Oleg 
[Kononenko] were in their Soyuz. We partially closed (to 
soft dock) our Soyuz hatches and then all sat quietly 
and waited for either a loud boom or [hopefully] the “all 
clear” call from Houston. Thankfully, 6:38:33 a.m. passed 
uneventfully and the ISS and its menacing interloper 
passed each other at a comfortable 16.5 km (10.2 miles) 
miss distance. We all floated out of our spacecraft, 
reconfigured the ISS hatches and systems, and enjoyed 
many more weeks of life and work aboard the ISS. 


Conclusion 

Despite a debris environment that 
has become more hostile over the 
decade and a half that ISS has been 
in orbit, Mission Control, NASA 
researchers, and JSpOC have 
correspondingly improved tools 
to protect the ISS and its crew. 
They have crafted methods that 
better track debris and characterize 
the threat from an identified 
conjunction with debris, and 
developed operational responses 
to help the ISS move into a safer 
orbit, rapidly, and avoid maneuvers 
unless absolutely required. 


As the population of debris in 
low-Earth orbit continues to worsen, 
these tools will continue to be 
refined to keep the ISS a safe and 
operationally useful laboratory. 
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Chapter 9 Systems: 

Electrical Power 
System—The Power 
Behind It All 




International Space Station solar arrays capture sunlight during STS-119/ISS-15A fly around. 


“Following the light of the sun, 
we left the Old World” 

- Christopher Columbus 

Electrical power is the lifeblood 
of the International Space Station 
(ISS). Literally, it is the energy that 
keeps the ISS running. The ISS uses 
electrical power to operate the various 
systems that ultimately allow crew 
members residing on the space station 
and scientists across the globe to 
perform world-class research. In turn, 
the Electrical Power System (EPS) 
relies on those systems to provide 
command and control, to cool EPS 
devices, and to pinpoint the location 
of the sun to harvest its energy. 

Previous NASA human spacecraft 
relied on consumables-based energy 
systems. Fuel cells used hydrogen 
and oxygen to produce power and, 


as a side benefit, water. This worked 
well for short-duration missions. 

For the long-duration mission of the 
ISS, resupplying these consumables 
would be cost prohibitive and 
would endanger the future of ISS 
operations, should the resupply be 
interrupted. Solar arrays and cells, 
along with batteries, proved to be 
viable power sources for satellites 
and were used in the Russian human 
space program—including the Mir 
space station. However, the energy 
demands of the ISS would require the 
largest solar power system ever (to 
date) to be designed, built on Earth, 
assembled in orbit, and operationally 
maintained for decades. 

Many design decisions drove the 
overall architecture and operations 
of the EPS early in the development 
of the ISS. Large design differences 


exist between the Russian Segment 
(RS) and United States On-orbit 
Segment (USOS), though they have 
the capability to transfer power to 
each other. Even the voltage at which 
the EPS operates has large impacts 
on hardware design and actions 
necessary for crew and ISS safety. 
Multiple independent power sources 
provide redundancy for critical 
systems and allow power to be 
rerouted in the event of a failure. 

The USOS EPS can be divided and 
discussed in many ways, but it may 
be easiest to compare it to how most 
homes on Earth receive electrical 
power. Similar to terrestrial power 
plants, the Primary Power System, 
operating at high voltage, is where 
solar energy is converted to electrical 
power and stored in batteries for use 
during eclipse. A combination of 
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mechanical joints are used to rotate 
the solar arrays and even entire 
truss elements to keep the large 
US OS solar arrays pointed at the 
sun. Similar to how transformers on 
utility poles near homes work, power 
is then converted to lower voltage 
in the Secondary Power System for 
use by end-user devices, or “loads,” 
such as computers and fans. A series 
of cables and power distribution 
units move power throughout the 
EPS and ultimately to users, as with 
high-tension power lines, buried 
cables, and even wiring inside homes. 
Finally, the EPS contains specific 
loads that support overall operations 
on board the ISS, including lights, 
switches, and extension cords. 

In summary, the ISS solar arrays 
collect power during insolation, 
when the ISS is not in the shadow 
of the Earth. This power is supplied 
to equipment throughout the ISS 
and charges batteries for use during 
eclipse, when the Earth shadows 
the ISS from the sun. Power flows 
through various distribution control 
devices and switches to reach end- 
user loads. 

This chapter will discuss the 
hardware and process of converting 
sunlight into useable power and 
safely distributing it throughout the 
space station. Although many power 
systems used on the ISS are similar 
to those in terrestrial electrical 
networks and homes, the need for 
redundancy and the ability to be 
operated from far away in Mission 
Control require a number of critical 
design choices. The massive solar 
arrays on the ISS demand a great deal 
of interaction by the flight control 
team due to a number of constraints 
on the solar array operations, many 
of which were imposed after their 
design, including when and how 
other vehicles can dock. 


Background: 

Design Decisions 

Distributed vs. Non-distributed 
Electrical Power System 

The first ISS modules were designed 
with non-distributed EPSs. This means 
each module has a self-contained 
EPS that is able to generate, store, 
and distribute electrical power. Each 
module has its own solar arrays, 
batteries, distribution network, 
switches, etc. This structure was 
essential for early space station 
modules so that they could be 
essentially turnkey after launch, 
thus not requiring assembly or 
crew tending on orbit. The Russian 
Functional Cargo Block (FGB) and 
Service Module (SM) are based on 
designs used for the Mir space station, 
where non-distributed EPSs worked 
well. However, having each module 
outfitted with its own EPS adds mass, 
complexity, maintenance, and overall 
cost. As the ISS grew, new modules 
would potentially shadow the solar 
arrays of other modules, thereby 
causing loss of necessary power 
generation. In fact, deployment of 
the External Thermal Control System 
(ETCS) radiators (see Chapter 11) 
on the PI and SI truss segments 
physically interfered with the FGB 
solar array rotational envelope. This 
required the FGB solar arrays to 
be retracted, which greatly reduced 
their power-generation capabilities. 
The FGB then became dependent on 
power transfer from the USOS. 

The USOS EPS and later RS modules 
were designed using a distributed 
EPS. Power is generated and stored by 
specifically designed power modules 
and then distributed to the rest of 
the ISS where it is needed. Having 
dedicated power modules reduces the 
mass required by having replicated 


power systems such as batteries and 
converters for each module. However, 
this warrants much larger solar arrays 
and batteries to meet the power 
demands of the ISS. These large solar 
arrays were placed farther from other 
modules, which allowed the arrays to 
be positioned to see the sun and avoid 
sunlight blockage from other modules. 
The design trade was that it would 
take multiple Space Shuttle missions 
over the course of years until the 
USOS Primary Power System would 
be fully assembled. This meant full 
capability and redundancy was not 
available until well into ISS assembly, 
which resulted in a limiting effect 
on the amount of science conducted 
on the ISS early in its lifetime. 
Additionally, this caused many 
changes in procedures and training for 
ground controllers and crew. Almost 
constant work was required to keep 
the operations team in sync with the 
current configuration. 

Current, Voltage, and Mass 

Going back to the beginning of the 
earliest uses of electrical power, 
arguments took place over the benefits 
and detriments between alternating 
current (AC) and direct current 
(DC). In the 1880s, this became a 
famous “battle” between Thomas 
Edison (promoting DC) and George 
Westinghouse, who held patents 
to Nikola Tesla’s work with AC. 
Terrestrially, AC won out due to 
cost and efficiency, with the United 
States using a 110 Volt AC system 
and the European standard 220 Volt 
AC. However, solar array and battery 
system designs naturally generate 
and store energy using DC. In fact, 

28 Volt DC systems have become an 
aerospace industry standard. However, 
it can be difficult to efficiently change 
the voltage in a DC system; and, 
as will be discussed later, the ISS 
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DC-to-DC Converter Units (DDCUs) 
actually make use of AC to change 
voltage levels. The ISS also uses 
DC-to-AC inverters to provide US 
standard 110 Volt AC power to user 
loads in an effort to reduce cost and 
make use of commercial off-the-shelf 
(COTS) equipment. 

As mentioned above, 28 Volt DC 
systems have become an aerospace 
standard, and this standard was used 
for the RS EPS. However, low-voltage 
DC systems require higher currents 
and therefore larger, heavier cables to 
meet user power demand. To reduce 
mass, especially in a distributed power 
system, the USOS was designed to use 
higher voltages, which would require 
lower currents and smaller cables. The 
USOS uses an approximately 160 Volt 
DC primary and an approximately 
124 Volt DC secondary system. 
Although this accomplished the 
goal of allowing smaller cabling to 
reduce mass, it also resulted in a few 
design impacts. As a new standard, 
user equipment had to be designed 
to either use the higher voltage or 
require additional support hardware 
in the form of power converters and 
inverters. Additionally, the higher 
voltage poses safety risks to both 
the hardware and the crew. Higher 
voltage presents a greater chance of 
electrical arcs, which could potentially 
cause damage to connections that 
are being mated (connected) or 
demated (disconnected). One result 
of this damage could be the release of 
molten metal, which might penetrate 
a spacesuit or cause physical harm to 
the crew in microgravity. Additionally, 
the higher voltage increases the 
electrical shock risk to the crew 
member when working with electrical 
connections. Therefore, safety 
requirements call for multiple levels of 
inhibits (i.e., steps to prevent electrical 
current flow, such as adding an open 


switch) to prevent exposing the crew 
and hardware to this high-voltage 
potential during electrical connector 
operations. Operationally, this requires 
removing power at higher levels, or 
“upstream,” in the EPS architecture 
and therefore powering down multiple 
pieces of equipment to replace one 
device. To relate this to the average 
home, it would be comparable to 
requiring the resident to turn off the 
room circuit breaker as well as the 
light switch when replacing a light 
bulb. Although this many levels 
provide additional protection against 
arcing and shock, it can add risk by 
unpowering perfectly good devices 
and removing redundancy. 

Trip Coordination 

Another overall design aspect of 
the EPS is current trip coordination. 
This is called a “sating function” 
because it places the hardware in 
a safe (unpowered) configuration 
while also trying to preserve as much 
functionality when faced with a 
malfunctioning piece of equipment. 
Electrical current sensors throughout 
the EPS monitor and report the 
amount of current flowing between 
electrical devices. When one of 
these sensors detects a higher-than- 
expected current, automated actions 
called “trips” are taken to open 
switches or deactivate equipment 
to remove the potentially hazardous 
situation. Usually, the higher current 
is caused by an electrical short (e.g., 
electrical wires crossed or touching) 
in the hardware and could lead to 
an electrical fire if left uncorrected. 
This is identical to a fuse or circuit 
breaker in a house activating and 
removing power when too many 
devices are connected to one electrical 
socket or when one device has 
become damaged. Trips need to be 
fast—on the order of microseconds 


or milliseconds—to protect hardware 
and cabling from damage. If a lower- 
level device did not trip fast enough, 
the higher current draw would be 
seen by higher-level devices. If the 
high-level device trips, power would 
be removed from more equipment 
than necessary. Therefore, the trip 
times are fastest at the lowest levels 
and lengthen higher in the EPS 
architecture. However, some devices 
on the ISS (e.g., motors on larger 
pumps) have startup transients that 
require additional current for short 
durations. This additional current 
may be enough to trigger the EPS trip 
functions. Some EPS devices were 
designed to “current limit” prior to 
tripping to handle these situations, 
where necessary. Current limiting is 
a function where an EPS device can 
actually adjust both output voltage and 
current so that, on average, the level 
is safe in an attempt to manage total 
output power. Limiting the current 
prevents upstream EPS devices from 
seeing higher current draws, thus 
preventing trips, while allowing a 
short time for device startup transients. 
Usually, the current is limited for only 
hundredths of seconds. If the transient 
has not ended in that time, the trip 
function will remove power from 
“downstream” load(s). 

Remote Control 

A design goal of the ISS was to make 
as many systems as possible remote 
controllable. Although this created the 
need for a robust Command and Data 
Handling system (see Chapter 5), 
it allowed for mass savings (i.e., 
less physical switches) and overall 
control from the ground for times 
when the crew was not available. 

In turn, this allowed the crew to 
focus on scientific research instead 
of day-to-day ISS operations. Most 
USOS EPS devices have firmware 
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Assembly Complete US EPS Power Channel Naming Convention 

8 power channels (1 A, 1B, 2A, 2B, 3A, 3B, 4A, 4B) Odd numbers are starboard, even numbers are port 

4 photovoltaic modules (S6, S4, P4, P6) A panels are inboard, B panels are outboard 


controllers (small computers) that 
interface with the Command and Data 
Handling system to provide data and 
receive commands. These firmware 
controllers monitor current, voltage, 
and temperature sensors to provide 
insight into the health and function 
of the EPS. They also respond to 
commands from ground controllers, 
crew members, or automated software 
functions on board. These commands 
can open or close switches, turn 
automated functions on or off, or 
change the modes or set points 
that manage EPS operations. One 
downside is that the system had an 
increased dependence on computers 
to safe hardware. This is especially 
evident when certain computers 
control their own power switches. If 
one of those computers malfunctions, 
it may be necessary to go farther 
upstream in the EPS to remove 
power from the faulty computer, thus 
impacting other user loads. In fact, 
a significant part of a module may 
need to be powered down to change 
out the faulty computer. Although 
remote-control capabilities have 
proven beneficial for freeing up crew 
time and potentially saving the ISS 
if a crew is not available to respond 
to off-nominal situations, having 
practically no manual overrides in the 
EPS also has its detriments. 

System Overview 

Power Channels 

The USOS EPS is divided into eight 
power channels: 1 A, IB, 2A, 2B, 3A, 
3B, 4A, and 4B. A power channel 
contains the equipment necessary 
to generate, store, and distribute 
power as an independent source. It 
also contains support equipment for 
command and control, cooling, and 


Figure 1. ISS PVMs and power channels. 

solar array pointing to keep the power 
channel functioning. The primary 
power equipment responsible for 
generating and storing electrical 
power is located on four Photo- 
Voltaic Modules (PVMs): the P4, 

P6, S4, and S6 truss segments. Each 
PVM supports two power channels. 
Hardware for channels 1 and 3 
is located on the starboard truss; 
hardware for channels 2 and 4 is 
located on the port truss. The two fully 
independent and redundant power 
channels are labeled A and B. Channel 
A runs on S4 and P4, whereas B is 
connected to S6 and P6 (Figure 1). 

A subset of power channels—1 A, 

IB, and 2B—are considered to be the 
core power channels. These channels 
provide power to some of the most 
important space station systems 
hardware such as critical avionics 
(e.g., computers and communications 
equipment), life support systems, and 
external and internal Thermal Control 
Systems. These core channels and the 
concept of electrical power domains 


greatly impact how redundancy of 
critical systems was designed and is 
maintained on the ISS. Operationally, 
it is important to note that these 
critical systems are unevenly 
distributed across these core channels. 
Channel 1A supports ETCS Loop A, 
while channel IB powers one string 
of critical avionics. However, channel 
2B alone supports ETCS Loop B and 
one string of critical avionics. Due 
to this uneven distribution, loading 
on channel 2B is higher than the 
other core channels and takes more 
planning to keep it within energy 
balance when the ISS is in a power- 
constrained configuration, such as one 
that occurs during vehicle dockings 
(e.g., requiring a solar array to be in a 
fixed position). 

Domains and Redundancy 

Even with the best designs, ISS 
hardware and systems can wear 
out and fail. Critical systems have 
backups and sometimes multiple 
backups to keep the space station 


SYSTEMS: ELECTRICAL POWER SYSTEM-THE POWER BEHIND IT ALL CHAPTER 9 


159 





safe and functioning, should such an 
event occur. Generically, the concept 
of providing backup capabilities is 
called “redundancy.” Redundancy can 
be implemented by having multiple 
systems that perform the same 
function, such as multiple radios or 
computers. For less-critical functions, 
redundancy might mean having one 
system that can be powered from 
different sources. 

When designing the overall 
redundancy of the ISS, engineers 
defined the USOS EPS as separated 
into two domains: the 1/4 domain 
and the 2/3 domain. The 1/4 domain 
is made up of power channels 1 A, 

IB, 4A, and 4B; the 2/3 domain 
consists of power channels 2A, 

2B, 3 A, and 3B. As noted above, 
critical ISS systems are split 
between channels 1A and IB on 
the 1/4 domain and channel 2B 
on the 2/3 domain. However, not 
only are critical loads split between 
these domains, so are auxiliary and 
payload equipment. Two physical 
features define the power domains: 
cooling of associated EPS devices 
by different ETCS loops, and the 
placement of associated core power 
channels on opposite sides of the 
ISS (i.e., port and starboard). The 
ETCS Loop A, while powered by 
the 1/4 domain, provides cooling for 
critical 1/4 domain EPS hardware. 
Similarly, the ETCS Loop B, while 
powered by the 2/3 domain, provides 
cooling for critical 2/3 domain EPS 
hardware. Placing the core power 
channels on opposite sides of the 
ISS eliminates reliance of those 
channels on the same Solar Alpha 
Rotary Joint (SARJ) for solar 
pointing. Failure of a SARJ would 
greatly degrade the capability to 
orient half of the power channels 
for solar pointing, but would only 


affect the core channels of one power 
domain. However, redundancy was 
built into the SARJs themselves, 
and they can be controlled by either 
domain (see below). 

Overall, redundancy of ISS systems 
is provided by identical redundant 
equipment (i.e., a prime and a 
backup) that are separately powered 
by one of the two power domains. 
However, some device power 
supplies were designed to have 
multiple inputs, meaning the same 
piece of hardware can be powered by 
the two different domains so that if 
one should fail, operation would not 
be interrupted. Dual power feeds are 
more common to payload equipment 
where power redundancy supports 
mission success for that unique 
payload hardware, versus separate 
fully redundant critical systems 
equipment required for ISS safety. 

Off-nominal—Power Channel 
Cross-ties 

Failure of a power channel can have 
wide-ranging impacts to both the 
ISS systems and the payloads. The 
USOS power system was designed 
to be able to electrically connect 
the primary power outputs of the 
channels, called “cross-tying,” to 
provide some flexibility in the face of 
a power channel loss. The channels 
can be tied together in a specific order 
using the Main Bus Switching Units 
(MBSUs), which will be discussed in 
more detail. 

Originally, the capability required that 
a power channel output be removed 
before another channel could be tied 
to additional downstream loads to 
prevent the two power channels from 
trying to power the same bus, which 
could potentially cause instability 
and additional failures. This would 


require the deactivation of all loads 
associated with the channel being 
shut down. Known as a “cold cross¬ 
tie,” this capability works well 
when a channel shutdown/loss is 
unavoidable or unexpected. However, 
if a power channel was planned to be 
shut down, it would be beneficial to 
allow downstream loads to remain 
powered and seamlessly move them 
to a good power channel. 

The operations and engineering 
teams developed a process of using 
software and hardware already on 
board to perform a seamless power 
channel handover or “hot cross¬ 
tie.” Depending on overall power 
demands, some loads on either 
channel may still need to be powered 
down to prevent overloading the good 
channel. The voltage set points of the 
suspect channel would be lowered 
within the Primary Power System 
control range by using software and 
firmware commands. The MBSU 
cross-tie function would then be used 
to electrically connect the suspect 
channel to a good channel—one 
operating at the nominal Primary 
Power System voltage—without 
the loss of all downstream loads. In 
other words, the solar array output of 
the suspect channel would be taken 
off-line and its batteries would be 
configured to discharge at a lower 
voltage than the batteries of the 
good channel. Therefore, when the 
suspect channel sees the nominal 
voltage level, its batteries will start 
charging, and the good channel will 
supply power to the downstream 
loads. The Primary Power System 
portion of the suspect channel can 
then be gracefully deactivated or 
configured to a dormant/keep¬ 
alive configuration until required 
maintenance is completed. 
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Contingency—Jumpers 

Whereas cross-tie functionality 
provides for the loss of a power 
channel, certain failures in the 
Secondary Power System or Thermal 
Control System would still remove 
power from critical ISS systems. As 
the ISS was assembled, the operations 
and engineering teams devised the use 
of physical connectors and cables to 
“jumper” around these failures, kind 
of like an electrical detour. Sometimes 
these jumpers make use of electrical 
connections that were originally 
intended for temporary use during 
ISS assembly (see Introduction). For 
example, the Lab-Truss Contingency 
Jumper provides secondary power 
from a DDCU inside the US 
Laboratory module to critical loads 
on the PI or SI truss segments. 

This capability originally existed to 
provide power to truss loads prior to 
the permanent ETCS activation, and 
can now be used if an ETCS loop 
fails. Other jumpers reroute power 
between DDCUs, potentially stealing 
power from payloads for critical 
systems (e.g., sacrificing science to 
maintain life support). 

Specific jumper cables and 
procedures have been designed for 
multiple failure scenarios. However, 
not all scenarios can be covered. 

The potential for a failure to cause 
the loss of a particular device that is 
needed for safety or mission success 
still exists. In these cases, the crew 
could use spare electrical wiring and 
a pin kit to build a new connection 
(see Chapter 16). A solution cannot be 
guaranteed, but the operations support 
officers and the engineering teams 
have often proven their ingenuity 
and creativity in the use of pin kits 
in the face of unexpected failures. 

The downside to any jumper is that 


the crew must take physical action to 
install it. This can pull the crew away 
from scientific research, create the 
need to wake the crew in the middle 
of the night, or, worst case, cause 
an extended duration of equipment 
loss if the crew is unavailable to 
install a jumper. When an external 
cooling pump failed in 2010 and 
again in 2013 (see Chapter 20), 
jumpers were used to provide power 
to redundant systems until a 
spacewalk could be performed. 

Contingency — Planning, Energy 
Balance, and Load Sheds 

The solar array of each power channel 
can produce approximately 30 
kilowatts (kW) of power—or about 
three times the average household 
power consumption in the United 
States. However, once Primary 
Power System battery charging, 
housekeeping power (i.e., the power 
needed to operate the EPS devices 
themselves), and inefficiencies 
(i.e., energy lost, often in the form 
of heat, due to resistance in cables 
and during voltage conversions) are 
accounted for, each power channel 
can nominally supply about 12 kW of 
power to downstream loads. Higher 
loads, up to approximately 15 kW, 
can be supported for short durations 
at the risk of having an additional 
single-point failure cause an entire 
channel to trip off. Many factors 
can lower the power generated by a 
channel. The inability of solar arrays 
to track the sun, the ISS in an off- 
nominal attitude, or Primary Power 
System failures or maintenance can 
all lower the power available from a 
power channel. 

Power planning is one of the most 
work-intensive, ongoing operations 
for the Station Power, Articulation, 


Thermal, and Analysis (SPARTAN) 
flight controllers. Power planning 
includes determining the power 
availability and the load demand 
of each channel. Power availability 
is mainly driven by the solar 
array configurations and external 
environmental forces. During 
normal operations, the ISS solar 
array rotary joints are configured to 
track the sun as the vehicle moves 
along its orbit, thus maximizing 
the solar energy gathered for 
power production. However, due 
to multiple constraints, dynamic 
operations such as visiting vehicle 
arrival or departure and spacewalks 
may require the solar arrays to be 
fixed in specific positions called 
solar array “feathering.” Typically, 
at least one solar array feathering 
event happens weekly. When the 
solar arrays are not actively tracking 
the sun, power production can be 
greatly reduced to the point of not 
providing enough power to meet 
minimum power channel loads. Also, 
the natural occurrence of changing 
solar beta angle (see Chapter 7) 
affects the total power generation 
on the ISS. Low beta angles cause 
longer eclipse periods (i.e., where 
the arrays do not receive sunlight), 
which drove the design of the 
Primary Power System batteries. 
Eclipse periods are shorter at high 
beta angles; at their maximum value, 
the ISS is in continuous daylight for 
multiple days in a row. Although 
more sunlight might result in more 
power, it also impacts operations 
(e.g., the equipment can get too 
warm). If the Primary Power System 
batteries are not discharged, they 
can overcharge, thereby causing 
damage to the batteries. Or, they 
can develop a memory, meaning the 
full depth of discharge (i.e., time 


SYSTEMS: ELECTRICAL POWER SYSTEM-THE POWER BEHIND IT ALL CHAPTER 9 


161 



that a rechargeable battery can last 
on a single discharge) would not be 
available. Ground controllers must 
actively manage battery states of 
charge during high beta operations 
by reducing the current used to 
charge batteries and occasionally 
deactivating batteries to prevent 
them from overcharging. As a result, 
some of the power that is generated 
is wasted and cannot be used by the 
EPS. Annually, batteries must be 
reconditioned by taking each battery 
off-line and completely discharging 
it to remove any memory buildup 
and allowing the state of charge 
(SOC) software calculations to be 
updated. Additionally, the high 
inclination of the sun with respect to 
the orbit of the ISS can cause parts 
of the ISS structure to cast shadows 
across the arrays. This can reduce 
power-generation capability, cause 
changes in nominal heater control 
cycles (i.e., some items getting 
warmer or colder than normal), and 
potentially cause thermal stresses on 
hardware (see Longeron Shadowing, 
discussed below). ISS Program 
management has Groundrules 
and Constraints (see Chapter 1) 
that limit scheduling of dynamic 
events at high beta, due to these 
environmental effects of high beta 
and the solar array constraints often 
associated with dynamic operations. 
For example, visiting vehicles are 
generally not allowed to dock at 
these times of the year. 

The SPARTAN team develops a 
weekly solar array plan that takes 
into consideration any solar array 
positioning requirements and 
determines a time-phased power 
availability for each power channel. 
This availability is then adjusted 


for any Primary Power System 
maintenance that is planned, such 
as battery reconditioning. At the 
same time, the SPARTAN team 
gathers inputs from control centers 
around the globe to develop a usage 
profile that includes the standard 
systems power requirement (i.e., the 
overhead to keep the ISS operating), 
dynamic events loading, and payload 
requirements. The power availability 
is then compared to the load profile 
to determine whether the power 
system will be balanced. The strictest 
definition of energy balance would 
have the Primary Power System 
batteries discharge and recharge 
match on each orbit. 

From a planning perspective, 
the operations team plans for the 
batteries to fully recharge each 
orbit and is limited to a maximum 
discharge down to 65% SOC to 
prevent excessive wear on the battery 
hardware and maintain contingency 
reserve power in case of a failure 
preventing a battery from recharging. 
Furthermore, this protects the 
vehicle from significant failures. For 
example, if a system failure that will 
take a few hours to fix occurs when 
the batteries only have 30% to 40% 
SOC, there is a higher chance the 
system will lose all power before a 
recovery. If the power availability 
is greater than or equal to the load 
profile, the system is considered to 
be in positive energy balance (i.e. 
generating more electricity than is 
being used). If the power availability 
is less than the load profile, the 
system is in negative energy 
balance. Positive energy balance 
will allow the batteries to recharge 
to the same point they started on 
the previous orbit—hopefully fully 


charged. Negative energy balance 
will prevent the batteries from fully 
charging each orbit and will cause 
the batteries to discharge further 
each orbit until they deplete their 
usable energy. Negative energy 
balance on the ISS is often caused 
by dynamic events that create the 
need for solar array feathering, thus 
reducing the power availability. If, 
during weekly planning, the initial 
comparison of power availability to 
the load profile shows the ISS will 
be in negative energy balance, the 
operations team will work through 
multiple options to correct the 
situation. Usually, the team will 
develop a manual powerdown plan. 
Through this plan, ground controllers 
will deactivate noncritical equipment 
for the duration of the energy¬ 
negative timeframe, usually on the 
order of 2 to 8 hours. If a suitable 
powerdown cannot be found, it may 
be necessary to postpone an activity 
(e.g., dynamic event, payload, 
etc.) until power is available to 
support it. It may possible for the 
ISS to continue in negative energy 
balance during rare, high-priority, 
short-duration events. This would 
potentially cause additional wear 
of battery hardware and eat into the 
power available for contingencies. 
These cases are weighed against 
the risks of replanning the high- 
priority event (e.g., delaying the 
docking or spacewalk). All these 
operations are carefully defined in 
the flight rules, which detail under 
what conditions the batteries can be 
discharged below the nominal limits. 
The flight director will weigh these 
considerations when determining 
what level will be tolerated. 


162 


CHAPTER 9 SYSTEMS: ELECTRICAL POWER SYSTEM-THE POWER BEHIND IT ALL 



The System 

SAW 


Blanket 


J 


Blanket 


Array 

Strings SSU 

-P BGA 

M nr\ 


[W 


ECU 


Acronyms: 

BATT 

Battery 

BCDU 

Battery Charge/Discharge Unit 

BGA 

Beta Gimbal Assembly 

DCSU 

Direct Current Switching Unit 

DDCU 

DC to DC Converter Unit 

ECU 

Electronics Control Unit 

MBSU 

Main Bus Switching Unit 

PWR BUS 

Power Bus 

RPCM 

Remote Power Controller Module 

SAW 

Solar Array Wing 

SARJ 

Solar Alpha Rotary Joint 

SSU 

Sequential Shunt Unit 

[CH7] 

American to Russian Converter Unit 


BCDU 

3|E 


BAH 


BAH 


BCDU 

3C 


BAH 


BAH 


BCDU 

1IC 


DCSU 


SARJ 


From 

Another 

MBSU 


m jl r 

I MBSU I 


From 

Another 

Power 

Channel 


L"L 1 I 






PWR BUS 



PWR BUS 

1 RPCM 


RPCM 1 

1 RPCM 


1 RPCM 1 

l-l 

Users 

l-l 

Users 

L 


[CHT]s To 
Another 
MBSU 



PWR BUS 

| RPCM 

...|RPCMj 


I PWR B US 

RPCMl.J rp'cm 


MFT TFFT 

Users Users Users Users 


Figure 2. Diagram of an ISS power channel. Power is generated in the SAW and then passed through the SSU in the BGA to the DCSU or back to the arrays 
if too much electricity is being generated. The DCSU sends the power either to the batteries for storage or to downstream loads. From the DCSU, the power 
passes through the SARJ to the MBSUs. Electricity from the MBSUs can then be fed to other MBSUs, DDCUs, or Remote Power Controllers. 


Primary Power System 

As mentioned above, the Primary 
Power System (Figure 2) is the 
portion of the EPS that operates 
at a high voltage and includes the 
hardware needed to generate power 
during insolation, store and provide 
power for eclipse, and distribute 
power to the Secondary Power 
System. Most Primary Power System 
hardware is located on the PVMs 
associated with each power channel. 
The Primary Power System operating 
voltage range is 155 ± 22 Volts DC 


to provide flexibility and account for 
hardware degradation as the system 
ages. Usually, the solar arrays provide 
160 Volts DC during insolation, 
whereas the batteries provide 151 
Volts DC during eclipse. 

Solar Arrays 

Each USOS power channel has 
one Solar Array Wing (SAW) that 
contains the equipment necessary 
to deploy or retract the array, 
structurally support the array on 
orbit, and collect solar energy. Each 


SAW has two solar array blankets 
that contain 16,400 solar cells 
(32,800 cells per SAW). The cells 
are grouped together into strings 
that are combined to produce the 
voltage and current necessary for 
power channel operations. Each 
blanket also contains diodes between 
each string so that each string can 
be bypassed in the event the string 
is damaged or unable to produce 
power. A collapsible mast made up 
of longerons, battens, and cables 
is positioned between each blanket 
(Figures 3 and 4). 
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Figure 3. Partially deployed solar array showing two bays extended (see also Figure 4). 
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Figure 4. Solar array mast components. The longerons are collapsed when in the mast canister and 
then lock into place after extension. 


When retracted, each blanket folds 
into a box that is 51 cm (20 in.) 
tall. The mast is collapsed into a 
canister that is 2 m (6.6 ft) tall. When 
deployed, each SAW is 35 m (115 ft) 
long. A series of cables and a motor 
are used to deploy, retract, and hold a 


SAW taut. Each SAW was deployed 
during the ISS assembly Space 
Shuttle mission that delivered the 
associated PVM (Figure 5). 

The P6 SAWs, channels 2B and 
4B, were retracted during the ISS 



Figure 5. Deployment of ISS solar arrays, 
showing the beginning of deployment with a 
couple of bays deployed (top), partially deployed 
with 16 bays (middle) and fully extended with all 
32 bays extended (bottom). 

assembly sequence when it was 
necessary to move the P6 truss 
segment from its temporary location 
on top of the Z1 truss. The P6 SAWs 
were then redeployed during the 
STS-120/ISS-10A mission. The team 
experienced a lot of difficulties in 
getting the solar array blankets to 
retract and fold neatly into their boxes. 
Although this proved ultimately 
successful with the assistance of 
extravehicular activity (EVA) crew 
members, one of the channel 4B solar 
array blankets was damaged during 
the redeploy and required contingency 
EVA repair using unplanned/built- 
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on-the-fly materials (see Chapter 18). 
Due to these difficulties, no further 
plans have been made to retract the 
USOS solar arrays. However, some 
EPS maintenance requirements 
(i.e., Sequential Shunt Unit [SSU] 
replacement) originally called for 
solar array retraction to safe electrical 
connections. With no way to “turn 
off’ the sun, and with the retraction 
option essentially off the table, the 
operations community had to develop 
plans to perform these maintenance 
tasks with time-critical steps during 
limited eclipse periods. This is another 
example of the designer’s intentions 
being changed through the lessons 
learned by operating the ISS. 

Sequential Shunt Units 

The SSU is the primary power 
regulation device that controls SAW 
output. The SSU maintains its Primary 
Power System voltage set point 
(typically 160 Volts DC) by balancing 
the system demand with the number 
of connected array strings. Each array 
string can be individually connected 
or disconnected from the primary 
power bus. Array strings that are 
disconnected from the power system 
are shunted (shorted or rerouted back 
to the array). The output from the SSU 
is therefore the sum of all connected 
strings at any given time. The SSU 
also contains multiple sating functions 
that cause it to automatically shunt 
all array current, including output 
overvoltage (indicating that the SSU is 
not functioning correctly) and output 
undervoltage (indicating a possible 
electrical short downstream). 

Batteries 

The actual storage devices of the 
Primary Power System batteries are 
nickel hydrogen battery assemblies— 
three per power channel. In early 


2017, the team began replacing 
the nickel-hydrogen batteries with 
lithium-ion batteries. The new 
batteries provide more energy storage 
in a smaller box, with one lithium-ion 
battery replacing two nickel-hydrogen 
batteries. The batteries store power 
throughout the entire orbit. Array 
power is used to charge the batteries 
during insolation. A portion of the 
stored battery energy is discharged 
to supply the ISS loads during 
eclipse. Energy from the batteries 
may also be used to supplement 
the power-generation function 
during insolation. For example, 
if the load on a power channel is 
temporarily higher than the solar 
array can supply due to overloading, 
shadows cast by other space station 
structure, solar arrays purposely 
not tracking the sun, or a failure, 
then the batteries will discharge in 
parallel with the solar array output 
to maintain sufficient power to 
downstream loads. If all batteries 
are fully operational on a channel 
(i.e., not undergoing maintenance), 
the USOS EPS is designed to only 
discharge down to 65% SOC to 
supply the nominal ISS power needs 
during the period of orbital eclipse 
and can then be fully charged during 
a single period of insolation. The 
additional battery capacity would 
be used to support loads if solar 
array input power were to be lost. 

Battery Charge/Discharge Units 

The Battery Charge/Discharge Units 
(BCDUs) control the charging and 
discharging of the power channel 
batteries. During insolation periods, 
the BCDUs will charge, and then 
maintain the batteries at their 
maximum SOC. The discharge unit 
converter is a bidirectional power 
converter that can regulate the current 


level for charging the battery and 
regulate the voltage level produced 
when discharging the batteries. 
Typically, the BCDUs are set to 
regulate the output voltage level 
to 151 Volts DC. When the SSU is 
producing power (set point of 160 
Volts DC), the BCDU will sense the 
output voltage above its set point 
and operate in a battery-charging or 
maintenance mode. When the SSU 
output voltage drops, the discharge 
unit will begin to reduce the battery¬ 
charging current; when the voltage 
drops below the BCDU set point, 
the BCDU will begin discharging 
the batteries to maintain power to 
downstream loads. This transition 
is automatic and happens without 
crew or ground interaction. BCDUs 
also provide backup power to the 
Primary Power System components 
of the other power channel on the 
same PVM. This power enables 
only command and control of these 
components, and cannot be used to 
supply power to the downstream 
loads of that channel. 

Secondary Power System 

Direct-Current-to-Direct-Current 
Converter Units 

The DDCUs are the interface 
between the Primary Power System 
and the Secondary Power System. 
They convert the primary power 
range of 155 ± 22 Volts DC to 
the tightly regulated secondary 
voltage level of 124 ± 1.5 Volts 
DC. Numerous converter units are 
distributed throughout the USOS. 

In general, units are located in close 
proximity to the loads they power 
due to their operating at a lower 
voltage and higher current, which 
in turn requires larger cabling after 
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conversion. The three types of 
DDCUs include: external, located on 
the truss segments; internal, located 
inside pressurized modules; and heat 
pipe units, located on the Z1 truss. 
Although multiple differences exist, 
the main distinguishing feature of 
these converter units are how they are 
cooled. External DDCUs (cooled by 
the ETCS loops) and internal DDCUs 
(cooled by the Internal Thermal 
Control System) (see Chapter 11) are 
each designed to output 6.25 kW of 
power. Heat pipe DDCUs are rated to 
output only 3 kW of power due to the 
limited cooling provided by the heat 
pipes (i.e., small radiators that rely on 
the release of heat during the phase 
change of liquid ammonia to gas 
instead of active pumps). 

External and heat pipe DDCUs 
share the same external housing 
(i.e., thermal insulation and 
micrometeoroid shielding), which 
is not required for the internal units. 
The DDCUs operate on a demand- 
feed basis, meaning they will try 
to feed any amount of downstream 
loads, up to their maximum output 
trip limits. As the current draw 
increases (i.e., more loads), the 
voltage on the output decreases. The 
converter unit senses this drop and 
increases its power output to maintain 
the set point. Similarly, as loads are 
turned off, the current decreases, 
thereby increasing the voltage. The 
DDCU will sense this increase and 
respond to by decreasing its output. 
Two DDCUs are configured in a 
parallel configuration in several 
locations. In this configuration, each 
one receives primary power from a 
different power channel; however, the 
outputs of the two units are merged 
together to allow up to 12.5 kW to 
feed downstream loads. As long as 


the load is not greater than 6.25 kW 
on a single DDCU, these DDCUs 
can be configured to balance loads 
between the two input channels. If 
one of the parallel convert units were 
to fail, the other could still support 
up to 6.25 kW of downstream loads. 
The DDCUs have multiple sating 
functions that will automatically 
deactivate the unit if off-nominal 
input/output currents, voltages, or 
temperatures are detected by on¬ 
board computers. 

Power Distribution 

Once power has been generated and 
stored, it needs to be routed to the 
DDCUs to be converted to secondary 
power levels. Then it should be 
further routed to downstream 
loads, where the crew and ground 
controllers can activate and deactivate 
individual loads. The power 
distribution devices handle all of this. 
Additionally, the power distribution 
devices provide a large part of the 
trip coordination sating function that 
was discussed earlier. This function is 
performed primarily by Remote Bus 
Isolators (RBIs) and Remote Power 
Controllers (RPCs). 

Remote Bus Isolators 

RBIs are bidirectional, 
electromechanical relays that provide 
electrical paths between electrical 
buses—i.e., bundles of wires. This 
bidirectional capability means 
power can flow either way, allowing 
different power sources such as 
the solar arrays, batteries, or other 
power channels to reach downstream 
loads. RBIs can be remotely opened 
or closed via command and have 
overcurrent sating trips for current 
flowing in either direction. The 
specific limits on the current are part 


of trip coordination and will vary 
depending on the location of the RBIs 
in the EPS architecture. 

Remote Power Controllers 

RPCs are solid-state power switches. 
They allow power to be transmitted 
one way to the downstream loads. 
RPCs of various output current 
ratings can be found across the 
ISS and are used to provide power 
directly to user loads. These are 
the most common switches used by 
the crew and ground controllers to 
activate or deactivate loads. RPCs 
are, in effect, circuit breakers— 
similar to those in most households— 
that can be remotely commanded 
open and closed. 

Direct Current Switch Units 

The Direct Current Switch Unit 
(DCSU) is the electrical distribution 
box for a primary power channel. 

It routes power between the solar 
arrays’ SSU input, BCDUs’ batteries, 
and to downstream MBSUs or 
DDCUs. It also provides fault 
protection between each of these 
devices. See Figure 6. 

DCSUs are primarily an electrical 
bus with six RBI connections, seen 
in Figure 6. RBI 1 is the input power 
from the solar arrays or the SSU. 

RBIs 2, 3, and 4 are the feeds for 
charging or discharging the batteries, 
whereas RBIs 5 and 6 provide power 
to downstream loads. 

The DCSU power supply has three 
possible inputs. A BCDU located on 
the opposite power channel of the 
same truss segment provides backup 
power. It can also receive power 
from the solar array and batteries of 
the channel, or by backfeeding power 
from another channel. 
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Figure 6. DCSU distribution. Electricity comes in from the SSU through the BGA and, depending on the 
configuration of the RBI, is passed to BCDUs and downstream loads. 
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Figure 7. Example MBSU #1 distribution showing how power can flow using the RBIs to feed 
different DCSUs. 


Main Bus Switching Units 

The MBSUs are used to distribute 
primary power from the power 
channels to downstream DDCUs 
and other loads. They also provide 


the capability to cross-tie primary 
power channels to feed those 
DDCU loads in the event of a 
power channel failure or to restart 
a power channel. The SO truss 
segment contains four MBSUs, 


each of which has input from 
two primary power channels and 
outputs to several DDCUs or 
USOS to RS power converters. 

See Figure 7. 

The MBSUs provide a great deal 
of flexibility and redundancy in the 
electrical system by allowing 
various power sources to be 
connected, or tied, to other channels. 
Each MBSU contains two electrical 
buses and 14 RBIs. RBIs 1 and 8 
are nominally the input power from 
primary power channels; however, 
they can be used to backfeed power 
to a primary power channel, if 
needed, following a power channel 
failure. Other RBIs (2 through 5 
and 10 through 13) are outputs to 
downstream loads. The ability to 
cross-tie the inputs to different buses 
is accomplished by closing RBIs that 
connect those power channel buses. 
The two buses internal to the MBSU 
can be cross-tied by closing RBI 9. 
Since RBIs 7 and 14 are connected 
to adjacent MBSUs, they can be 
cross-tied to other power channels. 
Although it would be technically 
possible to tie all downstream 
loads to one power channel, the 
channel would not have the power 
availability to actually power all of 
those loads. Similar to the DCSU 
power supply, the MBSU power 
supply has three possible inputs, 
which provides for a great deal of 
operational flexibility. Power can be 
provided upstream of RBIs 1 and 8, 
allowing either input power channel 
to supply an MBSU. Another MBSU 
can provide backup control power 
via RBI 6 to allow cross-tying as 
necessary if power was lost from 
both power channel inputs. 


SYSTEMS: ELECTRICAL POWER SYSTEM-THE POWER BEHIND IT ALL CHAPTER 9 


167 
























Power Buses 



Figure 8. US Segment solar array angle rotation showing the rotation of the SARJ and the Beta Gimbal 
Assembly (BGA), as indicated. The BGAs allow the arrays to compensate for the j3 angle (see Chapter 
7 , Figure 7), which changes slowly over the year. The SARJ nominally rotates 360° as the space station 
rotates around the Earth to always keep the solar cells facing the sun. This angle is called the "a” 
(alpha) angle. 


Power buses provide the physical 
mounting structure for Remote Power 
Control Modules (RPCMs) and 
provide access to command and data 
interfaces, power input and output 
connections, and cooling. They do 
not have any active components 
(i.e., no moving switches or gears) 
and only provide structural, thermal, 
power, and data support for RPCMs. 
The number of RPCMs in each 
power bus varies depending on 
power requirements in that particular 
location of the vehicle. Power buses 
were not designed to be replaceable 
and can be found both internally and 
externally on the ISS. 

Remote Power Control Modules 

The RPCMs are the interface 
between the EPS and all non-EPS 
equipment on board the ISS. Because 
RPCMs are the most numerous 
EPS devices on the ISS, and due to 
their direct interface to downstream 
loads, the crew and ground have 
the most interaction with these 
items. The distribution of secondary 
power to downstream loads can be 
controlled by opening and closing 
RPCs within the RPCMs. Protection 
of the EPS against downstream 
faults is accomplished by opening 
RPCs when too much current draw 
is detected. The RPCMs come in six 
different configurations, each with 
a different number of RPCs with 
different current ratings and current- 
limiting capabilities. The type of 
RPCM used in any particular location 
depends upon the downstream load 
requirements. All RPCMs have the 
same housing and the same standard 
interface connectors, and can be 
located either externally or internally 
to the ISS. 


Pointing Systems 

To maximize the power generated by 
the solar arrays, the USOS EPS was 
designed with multiple articulating 
joints to allow the solar arrays to be 
rotated to point at and track the sun as 
the ISS orbits the Earth. Two separate 
kinds of rotary joints are used to 
position USOS solar arrays (Figure 8), 
due to the changing alpha and beta 
angles and the potential need to 
change ISS attitudes (see Chapter 7). 

Solar Alpha Rotary Joints 

The SARJs rotate the PVMs—entire 
truss segments—to provide alpha 
angle array pointing capability (i.e., 
when the ISS is in the nominal 
+XVV attitude). The port and 
starboard SARJs are located at the 


outboard end of the P3 and S3 truss 
segments, respectively, and provide 
360° continuous rotational capability 
to the segments outboard of P3 
and S3. The rotary joints normally 
complete one 360° revolution 
during each 90-minute orbit of the 
ISS around the Earth. Essentially, 
the SARJs are large gears rings 
with supporting bearings and drive 
motors. Each SARJ features two 
redundant control strings, one 
powered from each power domain. 
Each string consists of firmware 
controllers that include sensors to 
monitor the position and rotational 
speed of the SARJ, along with drive/ 
lock assemblies that house the motor, 
gear teeth, and locking racks used for 
positioning. See Figure 9. 
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Figure 9. Photo of a SARJ. The SARJ consists of two rings, with a utility transfer assembly (UTA) on 
the axel and two drive/lock assemblies (not shown). The rings consist of teeth (see Chapter 18) that 
move like a bike chain on the gear sprocket. The drive/lock assembly is used to either turn the gear 
teeth or lock the ring in position. The UTA allows commands and telemetry as well as electricity to pass 
back and forth using a roller ball assembly shown in Figure 10. 



Figure 10. Example roll ring. The gold stationary plate stays fixed while the outer section rotates. 

Part of a cable (black) is shown in one of the passthroughs on the inner stationary ring (the rotating ring 
connector is empty in this photo). Power or data is conducted through the metal flexures between the 
stationary and rotating rings to transfer electricity or data. 


A utility transfer assembly (UTA) is 
located at the center of each SARJ 
and provides the path for power and 
data transfer. The UTA has a roll ring 
structure, which consists of multiple 
stationary metal plates surrounded by 
rotating metal rings. Flexible metal 
rollers, called “flexures,” between 
each plate and ring maintain a 
continuous conducting path to pass 
electrical power or computer signals 
between the stationary plate and 
rotating ring. One plate-roller-ring 
set is required for each power or data 
connection that must pass through the 
rotating joint. These roll rings allow 
for 360° continuous rotation with 
seamless power and data conduction. 
See Figure 10. 

Beta Gimbal Assemblies 

The BGAs rotate individual SAWs 
to provide beta angle array pointing 
capability (i.e., when the ISS is in the 
nominal +XVV attitude). Normally, 
each BGA will rotate approximately 
±4° a day to compensate for the 
changing solar beta angle as the Earth 
orbits the sun. The BGAs provide the 
structural load path connecting the 
SAWs to the ISS truss structure while 
providing 360° rotational capabilities. 
They include roll rings for data 
and power transmission (similar to 
the SARJ UTA), a motor for SAW 
positioning, and two redundant 
anti-rotation latches for locking the 
BGA in specific positions. Software 
operates the BGA using multiple 
“modes.” The autotrack mode—the 
nominal mode—uses data from the 
Guidance, Navigation, and Control 
MDM on the relative positions of 
the ISS and the sun to calculate the 
angle that the BGAs should be moved 
to track the sun. The rate mode uses 
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a commandable (i.e., set by the 
SPARTAN flight controller) velocity 
to rotate the array at a constant rate 
irrespective of the relative motion 
of the sun. Rate mode does not 
automatically track the sun, therefore 
reducing power generation. It is only 
used in special circumstances, such 
as verifying the rotational capability 
of the BGA or obtaining imagery of 
all sides of the SAW. The directed 
position mode uses a commandable 
position to fix the BGA at a specific 
angle. Once in position, a motor 
will hold the BGA at the command 
position by attempting to correct 
for any external forces (i.e., thruster 
plume impingement). In cases where 
visiting vehicles are docking, it is 
desirable to park the BGAs at a 
fixed position to minimize plume 
impingement but at the expense 
of generating power. However, in 
safety-critical situations (i.e., an 
EVA crew member working near 
the arrays), one of the anti-rotation 
latches can be used to mechanically 
inhibit BGA rotation. In manual free 
mode, the motor is disabled, thereby 
allowing free rotation of the gimbal 
assembly. This mode might be used 
following a BGA failure by allowing 
an EVA crew member to manually 
position the SAW for better power 
generation for repair. 

Solar Array Constraints 

The USOS solar arrays can be 
rotated into any position required 
to point at the sun—barring any 
shadowing from other hardware— 
through the combined use of the 
SARJs and BGAs. After the ISS 
was completely designed, many 
constraints were applied to solar 
array positioning to protect the solar 
array hardware from damage. 


Thruster Plume Impingement- 
Structural Loads and Array Erosion 

Thrusters that control attitude on 
the ISS and visiting vehicles work 
by combusting fuel and oxidizer. 

The combustion products exit the 
thruster nozzle at a high speed, thus 
imparting a force on the vehicle in 
the opposite direction. The departing 
combustion products are known as 
a thruster plume. Thruster plume 
impacts, or impingement, on the 
USOS solar arrays, can have two 
effects—both negative. First, the 
thruster plume can impart a force on 
the solar array structure and cause 
bending and/or torsional loads. If 
these loads are too high, the solar 
array structure can be damaged. 
Second, if combustion products come 
in contact with solar cells, they can 
chemically or abrasively degrade the 
cells. This degradation would reduce 
the capability of the solar arrays 
to produce power. To combat the 
negative effects when the thrusters 
are firing, the USOS solar arrays are 
stopped and positioned facing edge 
on to, and as far as possible from, 
the thrusters. This reduces the forces 
imparted on the solar arrays and their 
exposure to combustion products. 
Many thruster plumes need to be 
avoided, especially when visiting 
vehicles arrive to or depart from the 
ISS, which creates a narrow range of 
acceptable locations for the USOS 
solar arrays. The less flexibility 
on solar array positions, the more 
power constrained the ISS, requiring 
load powerdowns to stay in energy 
balance. If the forces involved are 
high enough, the BGAs or SARJs 
(or both) may be mechanically locked 
into position to prevent inadvertent, 
perhaps plume-induced, rotation into 
a position that would risk damage to 
the solar array. 


Longeron Shadowing 

When the USOS solar arrays were 
deployed, some of the components 
combined to form four longerons that 
run the length the mast of each SAW. 
See Figure 4. 

When a solar array is tracking the 
sun, each of the four longerons are 
exposed to sunlight. However, if 
the solar array is not tracking the 
sun (e.g., parked for thruster 
constraints) or if other equipment 
blocks the sun (i.e., during high 
beta), it is possible these longerons 
can become shadowed. Whether a 
longeron is in sunlight or shadow 
will change the temperature of the 
longeron and can cause it to expand 
(lengthen) or contract (shorten). If 
the longerons of a single array mast 
are unevenly shadowed (e.g., three 
longerons fully in the sun while one 
longeron is fully in shadow), this 
expansion and contraction can cause 
uneven tension and compression 
loads on the longerons. Analysis 
has shown that uneven shadowing 
for as few as 20 minutes can cause 
enough thermal loading differences 
to damage the mast. 

When the constraints to prevent 
longeron shadowing and thruster 
plume impingement are combined, 
it can be very difficult to develop a 
solar array plan that protects solar 
array hardware while still producing 
enough power to meet the ISS needs. 

These constraints came about mainly 
due to design changes from early 
space station concepts. The biggest 
design change that magnified these 
solar array constraints was the 
addition of Russia as an international 
partner. The USOS solar arrays were 
originally designed for the Space 
Station Freedom. When Russia joined 
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the partnership, two major changes 
occurred in design modification from 
Space Station Freedom to the ISS that 
impacted the USOS solar arrays. First, 
the RS was added to the ISS design 
and included thrusters for vehicle 
attitude control. This eliminated 
the need for US Orbital Segment 
thrusters, which had been designed 
to limit plume impingement on the 
USOS solar arrays. The RS modules 
(and their associated attitude control 
thrusters) were based on elements 
of the Mir space station and did not 
take into consideration USOS solar 
array design or structural capabilities. 
Second, when Russia joined the 
ISS partnership, the inclination of 
the space station orbit was changed 
from 28° to 51.6° to make full use of 
Russian launch vehicle capabilities. 
This change in inclination also 
altered the beta angle range that the 
space station would see. At 51.6° 
inclination, the ISS would experience 
beta angles up to ±75°, which would 
cause times of no eclipses for days. 

In addition to exposing hardware to 
high temperatures at high beta angles, 
components of the ISS can cast 
shadows on other station equipment 
and thereby reduce solar power 
generation or create thermal gradients 
(i.e., longeron shadowing) that were 
not figured into the original design. 

Another constraint that has been 
applied to the USOS solar arrays is 
their use in reducing (or increasing) 
atmospheric drag on the ISS. Even 
at the orbital altitude of the ISS, 
there is enough of an atmosphere for 
the large surface area of the USOS 
solar arrays to cause drag on the ISS, 
especially when facing the direction 
of motion. This drag, although small, 
adds up over time, thus lowering the 
ISS attitude and causing the need 
for reboosts (see Chapter 7). To 


combat this constraint, the software 
used to calculate solar array angles 
to track the sun allows for biases to 
be applied. Biasing the solar array 
position can turn it more edge on to 
the velocity vector to reduce drag. 

Of course, this also turns it away 
from the sun, thereby reducing power 
generation and potentially causing 
longeron shadowing. This constrains 
when and how much bias can be 
used. As the ISS software developed 
over time, this biasing strategy was 
automated, which subsequently 
reduced the workload for ground 
controllers. Although uncommon, 
this strategy has occasionally been 
reversed to increase drag on the 
ISS to meeting visiting vehicle 
phasing constraints, as discussed in 
Chapter 14 (i.e., being in the right 
place at the right time for rendezvous 
or departure) without needing to bum 
propellant to deboost the ISS. 


Conclusion 

Operating the largest orbital solar 
power platform has been challenging, 
yet highly successful. Many design 
decisions and design changes have 
driven the need for automated 
software control and sophisticated 
analysis tools. The SPARTAN team 
continuously plans and adjusts 
EPS configurations to protect the 
ISS hardware and maintain power 
availability to critical systems and 
scientific payloads. The team must 
also be ready to respond to system 
failures or maintenance by adjusting 
plans or rerouting power—or both. 
Working with the ISS Program and 
engineering experts, SPARTAN will 
continue to maintain the ISS EPS 
in support of the crew, scientific 
research, and ultimately exploration. 
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Chapter 10 Day in the Life: 

Preparing for 
the Unexpected 




A close-up of the Node 2 module (center), one of the areas where toxic ammonia can leak into the habitable volume of the International Space Station. 


At 2:49 a.m. Central Standard 
Time, a red alarm illuminated the 
giant front wall display in Mission 
Control in Houston . The alert read: 
TOXIC ATMOSPHERE Node 2 LTL 
IFHX NH3 Leak Detected . 

The meaning was clear. Ammonia 
was apparently leaking into the 
Interface Heat Exchanger (IFHX) of 
the Low Temperature cooling Loop 
(LTL) in the Node 2 module. 

“Flight, ETHOS, I expect the crew to 
be pressing in emergency response 
while I confirm,” said the flight 
controller from Environmental 
and Thermal Operating Systems 


(ETHOS). In other words, the crew 
needed to don oxygen masks to 
protect themselves from ammonia 
while ETHOS looked more closely at 
these data. 

This was not a drill. When the red 
alarm appeared, the flight director 
turned her full attention to 
ETHOS. The words—unwelcome 
at any time from ETHOS—were 
especially jarring at an hour when the 
crew and the ground were humming 
along on a busy day of running 
experiments. Of the many failures 
for which the flight control team 
prepares, especially in simulations, 
this failure presents one of the most 


life-threatening situations, and one 
the team never wants to encounter on 
the actual vehicle. 

On January 14, 2015, this scenario 
happened on the International Space 
Station (ISS). Data on the ETHOS 
console indicated toxic ammonia 
could be bleeding in from the 
external loops, through the water- 
based IFHX, and into the cabin (see 
Chapter 11). Software on the ISS 
immediately turned off the fans and 
closed the vents between all modules 
to prevent the spread of ammonia. 

At the sound of the alarm, crew 
members immediately began their 
memorized response of getting to 
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the Russian Segment (considered a 
safe haven, since that segment does 
not have ammonia systems) and 
closed the hatch that connected to 
the United States On-orbit Segment 
(USOS). They took readings with a 
sensitive sensor to determine the level 
of ammonia in the cabin. The flight 
control team—especially the flight 
director, ETHOS, and the capsule 
communicator (CAPCOM [a holdover 
term from the early days of the space 
program])—waited anxiously for the 
results while they looked for clues 
in the data to see how much, if any, 
ammonia was entering the cabin. 
Already, the flight director anticipated 
multiple paths that the crew and 
ground would take, depending on the 
information received. 

No ammonia was detected in the 
cabin of the Russian Segment. 

At the same time, flight control 
team members looked at multiple 
indications in their data and did not 
see the expected confirming cues of 
a real leak. In fact, it was starting 
to look as if an unusual computer 
problem was providing incorrect 
readings, resulting in a false alarm. 
After looking carefully at the various 
indications and starting up an 
internal thermal loop pump, the team 
verified that no ammonia had leaked 
into the space station. The crew 
was not in danger. After 9 hours, 
the flight control team allowed 
the crew back inside the USOS. 
However, during the “false ammonia 
event,” as it came to be called, 
the team’s vigilance, discipline, 
and confidence came through. 

No panicking. Only measured 
responses to quickly exchange 
information and instructions. 

Hearts were pumping rapidly, yet 


onlookers would have noticed little 
difference from any other day. 

A key to the success of the ISS 
Program is that it is operated by 
thoroughly trained, well-prepared, 
competent flight controllers. The 
above example is just one of many 
where the team is unexpectedly 
thrust into a dangerous situation 
that can put the crew at risk or 
jeopardize the success of the 
mission. Both the flight controllers 
and the crews, often together, 
take part in simulations. Intense 
scenarios are rehearsed over and 
over again so that when a real 
failure occurs, the appropriate 
reaction has become second nature. 
After these types of simulations, 
team members might figure out a 
better way to do something, and 
then tuck that additional knowledge 
into their “back pocket” in the 
event of a future failure. Perhaps 
the most famous example of this 
occurred following a simulation 
in the Apollo Program. After the 
instructor team disabled the main 
spacecraft, the flight controllers 
began thinking about using the lunar 
module as a lifeboat. When the 
Apollo 13 spacecraft was damaged 
significantly by an exploding 
oxygen tank, the flight control team 
already had some rough ideas as 
to what they might do. Since the 
scenario was not considered likely 
owing to all the safety precautions, 
the team had not developed detailed 
procedures. However, the ideas 
were there. 

This chapter takes the reader into 
parts of a simulation to illustrate how 
the process really works. Material 
from Chapters 11 and 19 are heavily 
referenced in this section. 


Training 

By the time a flight controller is ready 
to sit in the Front Control Room, he 
or she has already undergone years 
of training. Generally, the team is 
made up of engineers. Positions and 
degrees are highly correlated (e.g., 
an electrical engineer supports the 
power systems, a computer scientist 
might support the computer systems); 
however, this configuration is not 
strictly required. Math and English 
majors, and even astronomers, serve 
as flight controllers. Initial training 
provides general knowledge of 
spaceflight operations, the vehicle, 
visiting spacecraft, the NASA 
organization, how to work with 
international partners, and even how 
to conduct meetings. Flight controller 
trainees participate in computer- 
based training and classroom 
lessons, as well as read manuals 
and instruction books. After initial 
technical expertise is achieved, the 
flight controller in training takes 
lessons on a Flight Controller Part 
Task Trainer (Figure 1). These small 
simulators mimic the telemetry 
generated for an individual system 
in a stand-alone fashion. A Station 
Power, ARticulation, Thermal, and 
ANalysis (SPARTAN) trainee, for 
example, will focus exclusively on 
power system displays and telemetry. 
This allows the student to see how 
his or her system will respond to 
commands or failures. For example, 
the trainee may execute a procedure 
while seeing how the real vehicle 
(i.e., the ISS) will react. 

Once the basic system knowledge is 
mastered, the flight controller starts 
supporting mini simulations (mini 
sims) as a team (Figure 2). In a mini 
sim, most of the ISS core functions 
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Figure 1. A student using the Part Task Trainer simulator. The student’s displays and data will mimic 
the real ISS in his specific system. 


are simulated by computers. The 
team works through various short 
scenarios (usually failures) to learn 
how to communicate crisply, resolve 
problems quickly, and to determine 
how to resume a particular task 
or mission. For example, a power 
failure in the electrical system 
will unpower equipment used by 
all the other systems. In the mini 
sim, the team will learn to identify 
the signature and communicate a 
recovery plan with the flight director, 
who might actually be an instructor 
playing the role. 

After mastering this, the students will 
support full integrated simulations, 
where the purpose is to stay on the 
timeline as everything possible fails— 
on purpose. While operators rarely 
see the same level of failures on the 



Figure 2. A team of operators practice working as a team in a mini sim. The instructor (far left) runs the simulation while also playing the role of the flight 
director, CAPCOM, ISS crew, and international partners. 
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real vehicle, this training teaches the 
flight controllers how to work as a 
team to solve problems often never 
anticipated, and how to work under 
pressure. While the flight controllers 
will learn the signature and responses 
of specific failures, the simulations 
also train them to approach a problem, 
should they not understand the 
signature they are seeing. More often 
than not, real failures in space are not 
anticipated or completely understood 
when first encountered. In the 
ammonia leak case discussed above, 
the failure that caused the signature 
was never anticipated. In fact, it was 
believed to be a failure mode that was 
not even credible or likely. Therefore, 
the team had to decipher the unusual 
signature in their data and figure out 
what to do in real time. 

An instructor, a senior flight 
controller in the group, or the 
student’s manager will evaluate 
each student through every phase. 
Several key areas are reviewed. One 
area is that of problem recognition. 
Identifying a failure and its impacts, 
especially within another system, can 
be difficult with complex systems 
and a large amount of data. Known 
failures have clear alarms, but what 
could have caused a box to fail may 
require some sleuthing. Other areas 
include mission cognizance (how the 
flight controller fits the failure into 
the bigger picture), communications, 
console management (how team 
members organize their data, logs, 
tools, and displays), and team 
interactions (either with other flight 
controllers or their own back room 
support). Even the student’s attitude 
is evaluated since someone who gets 
easily stressed or discouraged is not a 
good person to have on the team. 


After successfully completing 
the simulations and passing an 
evaluation by the flight director, the 
flight controller begins sitting on 
console under the watchful eye of an 
experienced operator in what is called 
on-the-job training. When the flight 
controller is considered ready, the 
“training wheels” are removed and he 
or she is certified as an operator—i.e., 
the first level of certification. That 
person can perform routine duties on 
console and respond in an emergency. 
For all systems except ETHOS, 
this generally means verifying that 
the software has reconfigured the 
systems automatically in response 
to the failure and then notifying 
an expert of the situation to obtain 
further direction. For ETHOS, the 
operator also supports the three 
big emergency responses on the 
ISS—fire, atmosphere leak, and 
toxic chemical spill—by leading 
the crew and flight control team 
through the associated procedures 
(see Chapter 19). For serious failures 
or complex operations, a more-senior 
controller (i.e., a specialist) who has 
undergone additional training and 
certification will support the console. 
Since training is so critical to the 
success of operations, the trainers 
(i.e., instructors) are part of the 
operations group and even support the 
console positions. This blending of 
operator/specialist/instructor ensures 
training is as accurate as possible. 
Once certified, flight controllers, 
instructors, and flight directors all 
must continue to perform proficiency 
training and evaluation to ensure they 
remain at peak performance levels. 
Flight directors are generally selected 
from seasoned flight controllers. As of 
December 2015, 91 individuals have 
been certified NASA flight directors. 


After all the generic training is 
complete, the controllers may be 
assigned to specific missions, such 
as an assembly mission (during the 
Space Shuttle era), a visiting vehicle 
(Soyuz or cargo flight), a software 
uplink, or a spacewalk. The assigned 
team will generally conduct flight- 
specific simulations in that unique 
timeline or activity. Complexity of 
the timeline determines the number 
of simulations, with the shuttle 
assembly missions having been on 
the high end with about a dozen, not 
counting numerous ascent and entry 
simulations with the crew. 

To illustrate the nature of this critical 
training, this chapter walks the 
reader through parts of a particular 
training session. The following is the 
transcript of real voice loop data in 
the Mission Control Center (MCC) 
recorded on April 24, 2013, during a 
generic simulation. 

Approximately 1 hour prior to the 
start of the event reflected in this 
transcript, the US Fab 1 Multiplexer/ 
DeMultiplexer (FA-1 MDM) 
experienced a failure such that it 
could no longer pass data to the 
Primary Command and Control 
MDM (see Chapter 5). Many impacts 
to the loss of communication to the 
FA-1 MDM occurred. A particularly 
important impact was that almost 
all insight into the performance of 
the FTF, which provided cooling 
to critical internal systems within 
the Faboratory Module, was lost 
(see Chapter 11). The Fab thermal 
system can be operated in dual mode 
or single loop. In dual mode, the 
FTF and the Moderate Temperature 
Foop (MTF) operate independently, 
each with its own pump. In single 
loop, the two segments are joined, 
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and one pump—either the Moderate 
Temperature (MT) or the Low 
Temperature (LT)—pushes fluid 
around the entire system, which 
is called Single MT or Single LT, 
respectively. This is significant 
because, at the time of the failure, 
the US Lab internal active Thermal 
Control System (TCS) was in Single 
LT mode, meaning one water pump 
on the LTL was performing all of 
the heat transport of cooling water 
to US Lab systems. The LTL pump 
remains running in the event of an 
LA-1 MDM failure as several key 
pump performance parameters are 
being reported to and controlled by 
a different MDM. However, loop 
pressure, flow, temperatures and, 
most importantly, pump accumulator 
quantities, are lost. The pump 
accumulator quantity is especially 
important because a sudden decrease 
in accumulator quantity indicates 
that cooling water is leaking out of 
the system. If the leak is not stopped, 
enough water will be lost to cause 
the cooling loop to fail and critical 
equipment to overheat. A sudden 
increase in accumulator quantity 
indicates that another fluid is being 
injected into the system. Given the 
way in which the internal cooling 
loop is plumbed, the only possible 
fluid that could be injected into 
the system is the 100% anhydrous 
ammonia that is used as a coolant for 
ISS external systems. The ammonia 
and water come into thermal contact 
to exchange heat, but are kept 
separate from each other at the 
IFHX (see Chapter 11). This grade 
of ammonia is fatal to humans, even 
in small quantities. Also, one of two 
redundant Internal Audio Controllers 
(IACs), which route all on-board 
voices to different destinations, 
failed prior to the simulation start in 


what is known as an initial condition 
of the simulation. Another initial 
condition was that the External 
TCS (ETCS) Loop B experienced 
a transient failure, which shut the 
pump down. 


Communications 

One of the most critical skills that a 
flight control team needs to exercise 
is communication. Owing to the 
complicated, often time-critical 
nature of spaceflight, a specific 
shorthand and cadence was developed 
to facilitate communication between 
the various controllers, the flight 
director, and the crew. Flight 
controllers in Mission Control 
communicate over loops, which 
is nothing but a dedicated phone 
line, so to speak, between parties. 
Typically, each person must listen 
to more than a dozen of these voice 
loops at the same time. Using a 
headset, a flight controller plugs 
into the system to hear the calls that 
are defined on a computer panel. 

There are literally thousands of 
loops from which to choose, but 
each person usually monitors only 
a small subset. Conversations can 
occur simultaneously on all the 
loops during busy times. Sometimes 
the flight controller needs to follow 
along with only a few, but at other 
times he or she may need to directly 
participate in the discussion. Learning 
to process all these simultaneous 
conversations is a key skill the flight 
controllers have to master. 

Calls between controllers begin 
with the name of the person being 
called, followed by the position 
that is making the call. For 
example, “SPARTAN, CRONUS 
on SYS COORD” indicates that 


the SPARTAN controller is calling 
Communications Rf Onboard 
Network Utilization Specialist 
(CRONUS) on the voice loop 
called SYS COORD, which stands 
for Systems Coordination. When 
CRONUS hears this, he or she will 
talk directly to SPARTAN. The most 
critical loop is the FLIGHT loop, 
which is owned by the flight director. 
In a real sense, this is the “king” of 
loops and everyone in every control 
center around the globe always has 
to monitor this critical loop. The 
only other special loop is the Space- 
to-Ground (S/G) loop. Only the 
CAPCOM talks to the astronauts on 
this loop. Since an astronaut’s time 
is so critical and communication can 
be limited, everyone is required to 
stop talking during a call from the 
CAPCOM to the astronauts, or vice 
versa. This prevents the ground from 
talking over and therefore missing 
an important item, or making it 
necessary for the crew members to 
repeat themselves. 

A key part of this communication 
training is to learn how to talk 
concisely. Unlike an office meeting 
where employees can take all the time 
necessary, discussions in Mission 
Control are usually time critical. If 
the discussions are not time critical, 
they are still kept to a minimum 
since everyone is monitoring 
multiple loops. Another way to keep 
communications crisp is to add a brief 
phrase to explain why the person is 
calling. This is indicated by stating 
“for” followed by what the call is 
about, thus allowing the receiver 
to prioritize and prepare for the 
discussion. Following is an example 
of a simple exchange during that 
simulation. NOTE: The transcript 
has been edited for readability. The 
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italicized information within the 
square brackets helps explain or 
clarify what is going on or what is 
meant by a particular acronym, word, 
or statement, but it is not part of the 
actual transcript. 

CRONUS: FLIGHT, CRONUS, for the 
IAC. /This is CRONUS calling the flight 
director about the previously failed IAC. 
Since the FLIGHT loop is the key loop, 
its name generally does not need to 
be used.] 

FLIGHT: CRONUS, FLIGHT. /The flight 
director is acknowledging the call and 
indicating that she is ready to talk to the 
CRONUS operator.] 

CRONUS: Yes, FLIGHT, so when we 
saw the IAC failure, we were initially on 
IAC 2. Audio FDIR [Failure Detection 
Isolation Recovery, an automated 
recovery algorithm, see Chapter 5] 
swapped us over to IAC 1. That swap 
was not successful, and then it brought 
us back up on IAC 2. So in order to 
clean up and recover voice, I ran 
Ground Avionics procedure 2.311, just 
blocks 1 and 2 which basically covers 
inhibiting Audio FDIR and reconfiguring 
[voice loop configuration] calls. I’d 
like to continue to press through that 
procedure. Normally you’d run this 
procedure to power up the failed IAC 
and check it out but since we started 
up on IAC 2 and it looks healthy, since 
we are back on IAC 2 now, I’d like to 
actually power up IAC 1, which is the 
one we weren’t able to recover on, and 
see if I can see any issues with that. 

FLIGHT: Ok, I concur, you’re go. 

CRONUS: Copy. [Shorthand for “I hear 
and understand you. ”] 

SPARTAN: FLIGHT, SPARTAN, for 
status. 

FLIGHT: SPARTAN, FLIGHT [i.e., “Go 
ahead, I’m listening.”] 


SPARTAN: FLIGHT, the pump is back 
up and running. At this point I am 
ready to re-integrate the interface heat 
exchangers [the automated response 
from an external pump failure is to 
isolate the external ammonia loop from 
the heat exchangers that transport heat 
from the internal water cooling loops 
in the various modules to the external 
ammonia loops], beginning with 
Node 2, Node 3, IPs [referring to the 
Japanese and European ISS modules], 
then Lab. 

FLIGHT: I’m sorry, say again, pump is 
running, then what? 

SPARTAN: The loop Bravo pump is 
up and running, at this point I am 
ready to re-integrate the interface heat 
exchangers, beginning with Node 2, 
going to Node 3, then the IPs, then 
the Lab. 

ETHOS: And FLIGHT, ETHOS, I copy, 
and whenever the heat exchangers 
are re-integrated a lot of times we get 
a little bit of overshoot, and there’s a 
potential for some undertemp [i.e., too 
cool] messages on the board but that 
should level off pretty quickly. There’ll 
be no action [by crew or ground] for 
those once we are integrated. 

FLIGHT: Copy. 

[Shortly after SPARTAN completed his 
commanding, a caution-and-warning 
message was displayed to the ground 
and the crew about an undertemp in 
the TCS] 

ETHOS: And FLIGHT, ETHOS that 
enabled caution was what I was talking 
about, no action for the crew. 

CAPCOM [on the S/G-1 loop]: Station, 
Houston, on 1, no action for the TCS 
caution. That was expected. 

ISS CREW [on the S/G-1 loop]: 

Copy Houston, no action for the TCS 
caution, thanks. 


The People Behind 
The Curtain 

The simulator—basically a series 
of computers that can emulate the 
behavior of ISS systems and the 
space environment—is a powerful 
tool. When a student is in the training 
control room, the data on his or her 
computer screen or console will 
look exactly like it would if it were 
the actual space station in orbit. 
SPARTAN, for example, can watch 
the solar arrays rotate as sunlight is 
converted to electricity and routed 
around the ISS until the station 
orbits into the Earth’s shadow and 
the batteries begin supplying all the 
power needed. With the flick of a 
wrist, the simulation team can fail a 
bus or converter. However, the key 
to the simulation is the training team 
that operates it. This team is led by 
the Chief Training Officer (CTO), 
who is essentially the flight director 
of the training world. 

Scenarios developed by the training 
team depend on the type of simulation 
being conducted. As the name 
implies, generic simulations focus 
on general skills of the team—i.e., 
communication, coordination, and 
problem resolution. In these types of 
simulations, the training team will 
induce a failure that impacts multiple 
systems. For example, a power bus 
may fail, which can affect every other 
group. Due to the robust redundancy 
of most ISS systems, these types 
of failures usually result in the 
flight control team learning how to 
reconfigure the operating systems 
(e.g., activating the redundant unit), 
troubleshoot the failed one, and 
recover the failed system, if possible 
(e.g., reboot the computer if that 
is the issue). At all times, the team 
must try to keep the planned events 
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Figure 3. The training team, led by CTO William Frank (green shirt) in their own Mission Control-like facility. A computer generates the fake ISS data that the 
flight controllers see in Mission Control. The training team is also looking at these fake data. However, unlike the flight controllers, the instructors can inject 
failures into the simulation at the stroke a mouse click. For example, they can make a pump suddenly overheat and fail, or make a computer start generating 
erroneous messages. 


(e.g., the spacewalk) continuing as 
scheduled. Flight-specific simulations 
are focused on a particular upcoming 
event wherein the actual team 
members who will execute the event 
train together. Generic simulations 
are populated with people at various 
levels of training. 

Failure scenarios can become fairly 
complicated. One or two system 
failures may not be much of an 
impact to the operations; however, 
they can combine to cause significant 
constraints or vulnerabilities to an 
additional failure. For example, 
consider a module that has two 
internal thermal control loops and 
two power strings: A and B. Thermal 
pump A is on power string A; thermal 


pump B is on power string B. If 
power string A fails, string B is used. 
Now, thermal pump B becomes more 
critical. Should anything happen with 
the thermal loop (e.g., the pump fails) 
or if power string B is interrupted, all 
cooling to that module will be lost. In 
this type of scenario, the team will try 
to anticipate the next-worse failure 
after the first failure. Thus, when 
string A goes down, the team will try 
to anticipate what to do to best protect 
the vehicle for the next failure. In this 
example, the team might get a power 
jumper ready to reactivate pump A by 
plugging it into the B system. 

The training team spends a significant 
amount of time learning the systems, 
the timeline, and the objectives in 


preparation for a simulation. This 
research may involve going into the 
simulator, testing failures, and seeing 
how the software responds. Not 
only does this help lead to a realistic 
simulation, on many occasion real 
software bugs have been caught 
before being loaded onto the actual 
vehicle. Several weeks in advance 
of a simulation, the CTO will lead 
development of a script for the run. 
The script defines what failures will 
occur, and when and what the training 
team anticipates the flight control 
team will do in response. Sometimes, 
however, the flight control team will 
make a decision, either in error or 
on purpose, and choose a different 
response than anticipated. In this 
case, the training team will conduct 
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the rest of the simulation “on the 
fly,” adapting to the team. In cases 
where the flight control team has not 
realized the impacts of some failures, 
the CTO will call for inserting that 
very failure for the purpose of driving 
home the lesson of missing these 
types of cases. Such was the case 
on the April 24 simulation, when 
the CTO decided to drive home the 
criticality of the problem with the 
LA-1 MDM that the inexperienced 
flight controllers were missing. 

The training team will continue to 
stack failures to force the team to 
think of options and prepare for 
the next failure. In a simulation 
(Figure 3), another failure will 
always occur. By being constantly 
hit with numerous failures, the 
flight controllers can see how the 
interconnectedness of the systems 
works. Students also become 
confident and comfortable around 
the failures so that when they happen 
on the real vehicle, they can say, “I 
know this.” 

ETHOS: [ETHOS is leading the team in 
procedure 4.111 ECLSS (Environmental 
Control and Life Support System)/ 

ITCS (Internal Thermal Control 
System)/PTCS (Passive Thermal 
Control System) RECONFIGURATION 
FOR LABI MDM TRANSITION OR 
FAILURE.] In my mind the next critical 
item would be step 2.3, moding my Lab 
ITCS [Internal TCS] to Single MT [the 
MT loop running with a single pump] 
because in the current state right now 
we’re basically buying into the risk of 
a next failure, we don’t have any leak 
detection, for both ammonia and water 
leak detection. 

FLIGHT: Ok, so do you want to go 
ahead and execute that step before you 
assess the LA-1 MDM failure? 


ETHOS: FLIGHT I don’t think the 
conversation will take too long, about 
our forward path, whether we just 
troubleshoot really quick or stay in this 
configuration. 

FLIGHT: Alright, you have a couple 
minutes. 

ETHOS: Copy FLIGHT. 

CRONUS: FLIGHT, CRONUS, for lACs. 

FLIGHT: CRONUS, FLIGHT. 

CRONUS: Yeah FLIGHT my command 
was not successful so I’ve powered off 
IAC 1, and I’m thinking about why we 
got that signature when we powered 
it up. 

FLIGHT: Ok, ETHOS and CRONUS, 
LA-1 MDM, you guys are talking about 
it, so what’s the thought on it? 

ETHOS: Alright FLIGHT, so, yes, I 
have discussed this a little bit with my 
specialist as well, and I tagged up with 
CRONUS, and my recommendation 
right now is that we hold off on any 
type of trying to regain the LA-1 MDM 
right now and I will just put the rest 
of my steps per that 4.111 procedure 
in work. My rationale here is that 
my Lab P6 CCAA [Laboratory Port 6 
Common Cabin Air assembly], the one 
that’s associated with this MDM is 
still running, however I have no insight 
into it, if we do the troubleshooting it 
would take my CCAA back down and if 
we’re not successful with it that CCAA 
down. That currently is the CCAA that 
is having condensate collection and 
we normally like to dry out our CCAAs 
before we shut them down. So after I 
configure all my stuff to safe with the 
LA-1 down, I would work a plan to 
try and swap that condensate over to 
another module, most likely we’d like 
the condensate to condense in Node 
3. So, those are the actions I’d look for, 
and swapping the condensate takes a 
little while. So, there’s that action, as 


well as, we’d eventually like to do that 
anyway, to get on our S6 CCAA to have 
good insight into it. 

FLIGHT: Ok, understand. 

CRONUS: FLIGHT, CRONUS. 

FLIGHT: Ok, so at that point ETHOS, 
when you do all that reconfiguration, 
you’d like to CRONUS to do the LA-1 
MDM troubleshooting? 

ETHOS: Yeah, as soon as we get 
condensation, and we’re comfortable, 
making sure that that CCAA is dry. 

FLIGHT: Ok, understand. 

ETHOS: As far as impacts, if for some 
reason we get forced our hand we can 
do it earlier, it’s not the worst thing in 
the world, but.. 

FLIGHT: And so, what’s the estimate 
time for that? A shift, two shifts, how 
much time do you need for all that? 

ETHOS: I would say at least the rest 
of my shift and [the next] shift FLIGHT, 
and if we can withstand holding off any 
troubleshooting till tomorrow that would 
be plenty of time to make sure we’re 
dried out on that Lab CCAA. 

FLIGHT: Ok, CRONUS, your input? 

CRONUS: Yeah, FLIGHT, CRONUS, I 
concur with ETHOS’S recommendation. 
There isn’t a rush to powercycle 
[rebooting a computer often can 
recover it ]ust as on the ground with 
a laptop or desktop] the LA-1 MDM. 

We need to look at it a little bit more 
obviously we don’t want to be running 
in this configuration with the MDM 
in Min Ops without any insight into it 
indefinitely, but if it, we’re definitely 
fine with it staying here in order for him 
to get into configuration. [Min Ops, or 
Minimum Operations, is a mode of the 
MDM that keeps it running some basic 
functions even though it is not receiving 
direction from the computer above it.] 
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FLIGHT: Ok, in the meantime do you 
already know what your troubleshooting 
plan would be, or... 

CRONUS: Yeah FLIGHT with it being 
loss of comm [meaning the Internal 
MDM cannot talk to the LA-1 MDM] 
the only thing we can do is to try to 
power cycle the MDM. I don’t have the 
specific procedures for you yet but I 
can get those for you if you’d like and 
put the whole plan together in a flight 
note [a text document that can be read 
and reviewed by the entire team]. 

FLIGHT: Yeah let’s go ahead and get 
that in work so that you have another 
shift to take a look at it. 

CRONUS: Wilco. [Short for “will 
comply. ”] 

The Emergency 

The team works through various 
failures for several hours (Figure 4). 
Each failure represents a singular 
problem for that particular flight 
controller and his or her system. The 
flight director, however, keeps track of 
all the failures and pays close attention 
to the overall picture with the goal 
of trying to complete the planned 
activities with minimal impact. While 
each controller may be dealing with 
one or two individual problems, the 
flight director is tracking issues with 
six to nine systems. Flight’s role has 
often been compared to the Chinese 
acrobat balancing spinning plates on 
long sticks. However, as challenging 
as these individual failures are, 
the most-critical issues facing the 
team are these emergencies: fire, 
rapid depress, and toxic atmosphere 
(see Chapter 19). Therefore, the 
trainers frequently push the team 
further with a major emergency, 
often after an exhausting round of 


system failures. After several hours, 
the situation turned very serious 
when an emergency alarm—TOXIC 
ATMOSPHERE - MANUAL 
ALARM - LAB—appeared, in red, 
on the big caution-and-warning 
display in the front of the control 
room. This meant the crew detected a 
toxic spill, possibly ammonia, in the 
Laboratory module. 

ETHOS: FLIGHT, ETHOS, I see the 
toxic atmosphere alarm. 

CAPCOM [on the S/G-1 loop]: Station, 
Houston, on 1, we see a manual 
toxic atmosphere alarm, can we get a 
status when you can? [No response 
from the crew.] 

ETHOS: FLIGHT, ETHOS. 

FLIGHT: ETHOS? 

ETHOS: Like I said my Lab ITCS due 
to the LA-1 MDM, I have lost insight 
into any type of potential ammonia 
leak. In this case FLIGHT I’d expect 
that the crew is doing their emergency 
response but for the team here on 
the ground we’re going into EMER- 
1 [the initial emergency response 
procedures, also known as the “Red 
Book”] procedure 3.3. 

CAPCOM [on the S/G-1 loop]: Station, 
Houston, Space to Ground 1, we 
assume you have pressed the manual 
alarm button for an ammonia release, 
and we are in 3.3, Emergency 3 
decimal 3, for ammonia release. That 
is our assumption. 

CRONUS: FLIGHT, CRONUS. 

FLIGHT: CRONUS, FLIGHT. 

CRONUS: I’d like to get a go for 
emergency comm config [shorthand 
for communications configuration, this 
procedure ensures that all voice loops 
can be heard in as many ISS modules 
as possible]. 


FLIGHT: You’re go. 

CRONUS: In addition I’m going to 
work on bringing up the PTR [Port 
Thermal Radiator] MDM as SPARTAN 
could need it for emergency response. 

[The PTR MDM is required if the 
SPARTAN has to lock the arrays in a 
specific position.] 

FLIGHT: Concur. 

ETHOS: FLIGHT, ETHOS. 

FLIGHT: Go. 

SPARTAN: SPARTAN concurs. 

ETHOS: FLIGHT, ETHOS. 

FLIGHT: Go ahead. 

ETHOS: There’s an action I want to 
do anyway but I’d like a go to transition 
my Lab ITCS to Dual [mode]. I’ll get 
better insight. 

FLIGHT: You’re go. 

ETHOS: Copy FLIGHT. 

FLIGHT: Ok, let’s see, GO, you can go 
ahead and call Spacecraft Emergency. 
fThis is a protocol that the Ground 
Controller (GC), who is responsible 
for the MCC infrastructure as well as 
interface to the NASA Space Network, 
invokes with the Space Network to 
make sure the ISS gets all available 
satellite communications assets 
and bumps other users from using 
those assets.] 

GC: FLIGHT, GC, I copy. 

CRONUS: FLIGHT, CRONUS, 
emergency comm config is in place. 

FLIGHT: Copy. 

ETHOS: And FLIGHT, ETHOS, I do 
see a positive DP/DT [shorthand for 
delta atmospheric pressure increasing 
over delta time, meaning something is 
coming into the pressurized volume] 
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Figure 4. /\ team of operators performs a simulation (different than the one discussed in the text) under the direction of Flight Director Courtenay McMillan 
(Tranquility Flight, bottom left). The simulation control room, formerly used for conducting Space Shuttle missions, is set up exactly like the main ISS flight 
control room (see Introduction). 


into the cabin, so this is an ammonia 
leak, it is leaking into the US Segment. 

GC: Two minutes to a TDRS handover. 
[This means that link with the Tracking 
and Data Relay Satellite (TDRS) is 
swapping from one satellite to another 
as the ISS orbits the Earth, and there 
will be a brief loss of communications 
until the radio link is established on the 
other satellite. During an emergency, 
it is critical for the team to understand 


when the ground does or does not have 
a communication link with the ISS.] 

ADCO: FLIGHT, ADCO per rule B2-359 
we need to enable auto-handover 
to the Russians. [The Attitude 
Determination and Control Officer 
(ADCO) is quoting a flight rule that 
indicates that if there is a chance the 
gryoscopes will not be able to maintain 
the control of the ISS, “auto handover” 
should be enabled. Auto handover 


is the process by which the US and 
Russian attitude control systems can 
take and give control to each segment. 
In the case of an ammonia leak into 
the cabin, an action that the team can 
take to mitigate danger to the crew is to 
vent the ammonia in the external loops 
overboard, which is a sufficiently large 
enough propulsive force on the ISS that 
the US control moment gyroscopes 
cannot maintain attitude control and, 
therefore, Russian thruster control 
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“Well that can’t be right.. 

Captain Barry “Butch" Wilmore, Expedition 41 and 42 


“It was January 14, 2015. There I was in the corner of 
Node 2, completely focused on the highly classified and 
highly volatile secret government experiment attached 
to the Maintenance Work Station before me, when all 
of a sudden . . 

If I were writing a novel or memoir, I might take the liberty 
to embellish the details a bit, as I did in the preceding 
sentence. Instead of working on a “highly volatile secret 
government experiment,” however, I was floating in the 
overhead of Node 2, digging through a 1.0 cargo transfer 
bag where my excess clothing was stored, trying to find 
some clean skivvies—that’s Navy speak for underwear— 
when all of a sudden . . . 

OK, it wasn’t sudden either. It was just the emergency 
warning tone. I say “just” because we’d had several of 
them in the preceding days. All of the warnings turned 
out to be false alarms as several of the highly sensitive 
sensors, which detect smoke in both the Russian 
Segment and Node 3, had annunciated. None of them 
had actually been smoke or fire—just dust kicked up by 
work that was taking place in the vicinity of the sensors. 

As the current station commander, I reminded the crew 
that one false alarm, or even several, does not mean that 
the next one will be false too. We had to maintain our 
vigilance and treat every emergency as real, and keep 
stepping through our memorized procedures. With this in 
mind, when the tone annunciated waaank whoop waaank 
(it’s difficult to describe a tone on paper), I stuffed my 
skivvie bag back into my clothing cargo transfer bag and 
quickly floated to the emergency panel, where I expected 
to see another “Fire” caution light. The only other lights 
are: “AP/AT”, which is short for cabin depress or leak; and 
“TOX”, which is short for an ammonia leak (Chapter 19). 

On Earth, a bit of ammonia in cleaning solution disinfects 
and helps get rid of tough kitchen stains, leaving that 
clean smell. The ammonia on station, however, interacts 


with water loops, which cycle inside of station and 
pick up heat. The loops then transfer that heat into 
the ammonia that flows to radiators on the outside of 
station, which dispel the heat into the vacuum of space 
(Chapter 11). The smell of ammonia, which should be 
outside the station, means it has found its way inside 
the station. Even brief exposure could mean returning 
to Earth as special cargo rather than as a crew member. 
Thus, when I finally focused on the emergency panel and 
saw “TOX” illuminated, my initial thought was, “Well, that 
can’t be right. We’ve never had that emergency on the 
ISS because that means . . . ammon/a!” That thought 
lasted about a nanosecond as the next thing I knew I was 
yelling, “Masks!” 

Without any of us even being aware, the training we’d 
gone over and over and over for years kicked in. Russians 
don’t use ammonia to dispel heat, so if we could get there 
and close the hatch, we could isolate ourselves from the 
potential toxic environment brewing in the US Segment. 
With protective mask in place, I grabbed two of my 
incapacitated crew members, quickly put masks on them, 
strapped them to my back, and continued translating 
toward the Russian Segment. . . 

OK, I didn’t do that either. Each crew member immediately 
donned protective masks and began translating 
toward the Russian Segment, thus implementing the 
memorized response. 

Via procedure, I ensured all personnel were on the 
Russian side of the Node 1 Aft Hatch before beginning 
the process of closing the hatch and thereby isolating 
ourselves from the US On-orbit Segment. As I locked 
the hatch closed, I remember peering through the small 
window in the center of the hatch and thinking, “I wonder 
if we’ll ever go back in there again.” 
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is required. As part of the normal 
process of using the powerful Russian 
thrusters, the US Solar Alpha Rotary 
Joints (SARJs) need to be locked into 
a specific position to prevent structural 
damage to the large arrays.] 

SPARTAN: FLIGHT, SPARTAN I’ll need 
to park my SARJs. 

FLIGHT: You’re go to park SARJs. 

ETHOS: FLIGHT, ETHOS. [Looking for 
a status.] 

ETHOS: FLIGHT, ETHOS my Lab ITCS 
is currently trying to transition to dual, 

I would have expected it to come back 
up already in Dual by now but that 
didn’t work. I’m still assessing why that 
is, but for the crew, it is the ammonia 
response in 3.3, they’ll be taking 
readings in the [Russian Segment] and 
they’ll be reporting that in step 8. If 
concentrations are high... and FLIGHT 
I see that warning [an additional red 
warning alarm appeared on the screen], 
that’s from the Lab ITCS, that transition 
didn’t work. I’ll troubleshoot that in a 
second, but for the crew, they should 
be calling, like I said, in step 8, their 
readings. If it’s high basically they’re 
going to go to step 9 and they’re going 
to go to the Soyuz and try to establish 
a clean zone in the Soyuz. If it is low, 
they’re going to go to step 18, and 
they’re basically going to try to wait, 
about 2 and a half hours, until they 
can scrub all that, and they’ll take 
continual readings... 

FLIGHT: Copy. 

SPARTAN: FLIGHT, SPARTAN, 

SARJs locked. 

FLIGHT: Copy, SARJs locked. 

ADCO: And FLIGHT, ADCO, auto 
handover to the Russians is enabled. 
[This means that if the USOS loses the 


Control Moment Gyro attitude control 
of the station, the Russian thrusters will 
automatically take over controlling the 
vehicle orientation.] 

FLIGHT: Copy. 

[FLIGHT confirmed this configuration 
with the Russian shift flight director on 
the MCC-M to MCC-H coordination 
loop. The Russian flight control takes 
part in the training as well.] 

CAPCOM [on the S/G-1 loop]: 

Station, Houston, Space to Ground 1, 
for a status. 

FLIGHT: CRONUS, FLIGHT. 

CRONUS: FLIGHT, CRONUS. 

FLIGHT: Are public calls good for the 
crew to call down? 

CRONUS: Good on the Russian 
Segment, yes. 

FLIGHT: Ok. 

CAPCOM [on the S/G-1 loop]: 

Station, Houston, Space to Ground 1, 
for a status. 

SPARTAN: FLIGHT, SPARTAN, for 
interface heat exchangers. 

FLIGHT: Go ahead. 

SPARTAN: FLIGHT since we cannot 
determine which side the leak is on I 
can close both sets of interface heat 
exchangers. This would remove heat 
rejection from all modules. [By shutting 
down the pumps, there will be less 
pressure potentially pushing ammonia 
into the cabin since the team is not sure 
where the leak is located; however, this 
means the thermal loops will not be 
able to remove heat from the systems.] 

FLIGHT: Ok. 

ETHOS: FLIGHT, ETHOS. 

FLIGHT: ETHOS, FLIGHT. 


ETHOS: That’s going to remove 
cooling, like he said, so let me try one 
more command to go to Single MT, 
to see if I can pick this back up and 
determine which side the leak is on. 

FLIGHT: Alright, so... 

ETHOS: And if not I think that would be 
the forward action to bypass those. 

FLIGHT: Alright, you probably have 
a minute or so. I don’t want to 
spend time. 

CAPCOM [on the SG-1 loop]: Station, 
Houston, Space to Ground 1, for a 
status. 

ETHOS: FLIGHT, ETHOS, I successfully 
went over to single MT, and I’m taking a 
look at my data to assess to see where 
this leak might be. 

CAPCOM [on the S/G-1 loop]: Station, 
Houston, Space to Ground 1, status. 

ETHOS: FLIGHT, ETHOS. 

FLIGHT: Status? 

ETHOS: Yes FLIGHT, I swapped over to 
Single MT, now I have insight into the 
entire Lab system, its one loop... 

FLIGHT: Can you confirm by pressures 
that they’ve closed the hatch between 
the two segments? 

ETHOS: Yes FLIGHT let me 
confirm that. 

ETHOS: FLIGHT, ETHOS, I cannot 
confirm that hatch closure between 
Russian Segment and US Segment 
right now, the pressures on the Russian 
Segment are very close to an in-family 
with the US Segment. 

FLIGHT: Ok. 

FLIGHT: All right so ETHOS you see 
the quantities in the accumulator 
increasing... 
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ETHOS: That’s right FLIGHT and 
because it’s a single loop I still cannot 
tell if it is associated with Loop Alpha 
or Loop Bravo. I recommend that 
just isolate those and vent those 
ETCS loops. [The flight controllers 
use the phonetic alphabet to prevent 
misunderstandings. Here ‘A’ and ‘B’ are 
called Alpha and Bravo.] 

CAPCOM [on the S/G-1 loop]: Station, 
Houston, Space to Ground 1, for a 
status, when available. 

ETHOS: And that procedure FLIGHT 
only has paths where we go to Dual 
and I figure out which loop it is on. 

I’m still... I don’t know if we have a... 
I’m taking a look at my procedures 
to see if we have one that covers this 
specific case... 

FLIGHT: Can we even get back to 
Dual? 

ETHOS: Let me think about that 
FLIGHT. 

GLAVNI [This is the spacecraft 
communicator in MCC-Moscow, 
translated into English, on the S/G-1 
loop]: Station, this is Mission Control 
Moscow on Space to Ground 1, can 
you read us? 

GO: FLIGHT, GO. 

FLIGHT: GO, FLIGHT. 

GO: FLIGHT the gaps have been filled 
for the next 24 hours. [This means that 
any gaps in the planned communication 
schedule with the ISS using the TDRS 
network have been filled but are forcing 
other users of the system off due to the 
spacecraft emergency.] 

SPARTAN: FLIGHT, SPARTAN, Lab 
interface heat exchangers bypassed 
and isolated. 

FLIGHT: Copy. 

ETHOS: FLIGHT, ETHOS. 


FLIGHT: ETHOS, FLIGHT. 

ETHOS: In the current situation 
that I can’t tell which ETCS loop it’s 
associated with I would recommend 
venting both loops. I’m basically 
doing this to try to keep the structural 
integrity of the Station. We do have 
PPR [Positive Pressure Relief, which 
kicks off when the internal pressure 
of the ISS is too high, vents some 
atmosphere overboard. However, this 
venting can produce a thrusting force 
that can cause the ISS to tumble out 
of control. This is why ADCO wants 
to make sure the Russian Segment’s 
power thrusters are ready to take 
control via auto handover]. However, we 
will hit that in about 30 minutes or so, 
there is one thing I could do I could try 
and mode back to Dual, I would expect 
it to work but of course it failed the 
first time too and I’m not exactly sure 
what caused that, if it is LA-1 induced, 
however I would think that it would 
still mode to Dual. Now that we are in 
Single MT it might work again. 

FLIGHT: Once we get to Dual can 
we actually vent both loops from 
that configuration with LA-1 MDM 
not available? 

ETHOS: That would be a SPARTAN’S 
call, if LA-1 affects that, I don’t believe 
it does. 

SPARTAN: It does not, FLIGHT. 

ETHOS: Going to Dual, FLIGHT, 
would just let us know which one it’s 
associated with. 

FLIGHT: Does it matter at this point? 
Which one it is? 

ETHOS: FLIGHT when you vent an 
ETCS loop you can’t regain it so we’re 
basically calling it quits on the ETCS 
loops and basically all the US Segment. 
We do have a ton of ammonia in there 
anyway so I’m just worried about safing 


the situation right now, so that’s why I 
would recommend venting both loops, 
since I cannot tell. 

SPARTAN: And SPARTAN concurs 
with that. 

FLIGHT: All right how many commands 
is it to go back to Dual? 

ETHOS: Two. 

FLIGHT: All right send us back to Dual. 

ETHOS: Copy FLIGHT I’ll put it in work. 

FLIGHT: Quickly. 

FLIGHT: SPARTAN do you have 
anything to suggest which loop you 
want to vent? First, anyway? 

SPARTAN: And FLIGHT I have no 
insight into this. From a venting 
standpoint, both loops are redundant; 
we would just need to pick the right 
loop to vent. Once we vent the loop it 
cannot be... 

FLIGHT: Ok, understand. 

FLIGHT: ATAs/Ammon/a Tank 
Assemblies, which can be used to refill 
a cooling loop] on orbit, right? We have 
ATAs on orbit? 

SPARTAN: We do have the ATAs, 
FLIGHT. 

FLIGHT: I’m more worried about 
keeping the USOS intact and not 
having to... 

SPARTAN: During the venting process 
I would be isolating the ATAs and 
then venting everything in the lines 
of the ETCS system. The reason that 
those lines would be damaged at 
that point is that the lines were never 
intended to bring water through them, 
so bringing the water through them, 
the ETCS lines, could cause permanent 
damage to them. 

FLIGHT: Copy. 
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FLIGHT: Alright you have your 
procedure ready? 

SPARTAN: I do FLIGHT I’m in 9.19 
and 9.20, Loop A, Loop B. I do have 
one step to park the TRRJ /Thermal 
Radiator Rotary Joint, which positions 
the external ammonia radiators] for 
structural integrity... 

FLIGHT: Why don’t you go ahead and 
do that. 

SPARTAN: Copy. 

FLIGHT: And CRONUS you have PTR 
back up? 

CRONUS: I do FLIGHT. 

ETHOS: FLIGHT, ETHOS. 

FLIGHT: ETHOS? 

ETHOS: Okay FLIGHT we are currently 
moding over to Dual, I will let you know 
how that goes, additionally I’m still 
looking at my pressures on Russian 
versus US segments, I still see the 
Russian Segment pressure increasing, 
and I have verified that we have good 
I MV [InterModule Ventilation] closure, 
between the two vehicles, so that’s 
indicative to me that the hatch is still 
open. 

FLIGHT: Okay let’s make a call to the 
crew to tell them that we are expecting 
them in the Russian Segment with the 
hatch between the US and Russian 
Segment closed, they should be 
in 3.3 in step 8 to call down those 
CMS readings [Chip Measurement 
System, which can detect airborne 
concentration of ammonia]. 

CAPCOM [on the S/G-1 loop]: 

Station, Houston on Space to Ground 
1, we are expecting you in 3.3 for 
ammonia release and we are waiting 
for your readings on step 8. We are 
also expecting you to be isolated in 
the Russian Segment with the hatch 


closed between the Russian and the 
US Segment. 

ETHOS: FLIGHT, ETHOS for ITCS 
status. 

FLIGHT: Go ahead. 

ETHOS: FLIGHT I got the Mode 
Unknown again, so I’m not....there’s 
no way I can... I can’t tell... I cannot 
basically put this into Dual loop mode, 
I’m missing something FLIGHT, the 
LA-1 MDM one of my valves is not 
transitioning over, so there’s no way 
I can actually split apart. So right 
now I recommend venting both ETCS 
loops. We do see it coming into the US 
Segment, and from what I can tell it’s 
going to be the entire station with equal 
pressures across the stack. Since we 
have not heard from the crew I’m pretty 
worried about the safety there so I’m 
going to stand down on any type of 
ITCS configurations and I’m going think 
about where I’m going to go to try to 
recover crew. 

FLIGHT: SPARTAN, you’re go to vent. 
SPARTAN: Vent both loops FLIGHT? 
FLIGHT: Vent both loops, yes. 
SPARTAN: Copy. 

ETHOS: FLIGHT, since we haven’t 
heard from the crew at all too I’d like to 
go ahead and call the entire team into 
looking at anything in their systems that 
might give us an idea of where the crew 
might be... if there’s any movement or 
activity at all on Station. 

SPARTAN: And FLIGHT, SPARTAN, just 
to let you know, my next command for 
both loops will vent the loops. 

FLIGHT: Ok, you’re go. 

SPARTAN: And FLIGHT, SPARTAN, for 
the team, both Loop Alpha and Loop 
Bravo are currently venting. 


FLIGHT: Copy, external loops venting. 

After some additional time working 
through the scenario, the call that 
brings relief to the hard working team 
is made. 

CTO: FLIGHT, CTO, on your loop. 

FLIGHT: CTO, FLIGHT. 

CTO: Yes ma’am I’d like to call the sim 
here. 15 minutes, let everybody take a 
break, come back at 3:30. 

FLIGHT: Copy, 3:30. 

The Debrief 

When a simulation ends, the team 
members almost always breathe a 
sigh of relief. For a number of hours, 
the team has been running at top 
speed, diagnosing failures, recovering 
systems, and pressing ahead on the 
timeline. But even when the sim 
ends, the work is not over. The last 
thing the team does is perform a 
self-critique—called a debrief—led 
by FLIGHT and the CTO. During 
debrief, the team will review the 
major events, this time with the 
training team explaining what was 
really going on. What did the flight 
control team members do wrong? 
What could they do better next time? 
In general, how did they do in terms 
of problem recognition, mission 
cognizance, communications, and 
team management, and how was their 
attitude? Although each individual 
flight controller strives to improve his 
or her performance, these simulations 
often result in a better way to 
coordinate, perhaps even including 
changes to flight rules or procedures. 

In the simulation from April 24, the 
failure that initially appeared minor 
but played a major role in the rest 
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of the sim was an issue with the 
LA-1 MDM. It had not completely 
died, but instead was still operating; 
however, the computer circuit 
that allowed it to talk to its bus 
controller—i.e., the Internal MDM 
(see Chapter 5)—was not operating. 
Thus, the LA-1 MDM still tried to 
control its pumps and valves, but 
the rest of the system could not talk 
to it. This MDM managed the LTL 
accumulator quantity. Normally, 
if the liquid in that accumulator 
increases, it means water from the 
other loop or from the ammonia line 
is leaking into the system. Yet, those 
data could not be reported because 
of the communication failure with 
the Internal MDM. However, in 
this sim case, those data could not 
trigger an automated alarm. The 
crew smelled the ammonia and 
pressed the manual alarm. Since the 
flight control team failed to fully 
recognize the configuration and the 
full implications, the CTO decided 
to change the sim plan and insert an 
ammonia leak. By the time a person 
smells ammonia, there is a significant 
chance it is too late because of the 
toxicity. Since the crew is well trained 
to perform a memorized response, 
indication that the hatches were not 
in their expected sealed position 
followed by the lack of response by 
the crew when called did not bode 
well. Yet, no one on the flight control 
team acknowledged that fact. 


Furthermore, the LA-1 MDM controls 
the Loop Crossover Assembly 
(see Chapter 11), which allows the 
thermal loops to be separated into 
two independent loops (i.e., dual). 
Since the flight controller did not 
recognize this issue, the attempts to 
transition to dual mode were failing. 
The team lost precious time since this 
transition was never going to succeed. 
In some areas, team coordination 
and communications during this 
simulation worked well. ETHOS, 
SPARTAN, CRONUS, and ADCO 
worked very well with regard to the 
solar arrays. They realized that if 
the loops were vented, the ISS could 
lose gyro control and would need 
to hand over to the power attitude 
thrusters of the Russian Segment. 
Before this could be done, the massive 
solar arrays had to be put into a safe 
configuration. This, in turn, required 
the PTR MDM to be recovered. 

Although the team did everything 
in its power to save the crew, this 
simulation drove home that mistakes 
and failures can put crew members at 
risk or get them killed. Simulations 
such as this emphasize the need 
for vigilance, responsibility, and 
competence to the flight controllers. 
Lives are in their hands, and this can 
never be forgotten—not even for a 
moment. The team repeated many 
additional simulations so that when 
faced with a critical event, such as 
the one that occurred in January 
2015, the same mistakes would not 
happen again. 


Why NASA Trains 

The integrated simulation is the 
capstone training event for every 
flight controller. A flight controller 
must demonstrate technical expertise 
for his or her system before 
participating in a simulation. Yet, 
the simulation is where the flight 
controllers come together as a team. 
By performing simulations prior to 
the actual event, teams have been 
able to avoid numerous problems in 
space. Teams that had been drilled 
over and over again by the instructors 
were better able to handle a given 
problem, as was the case that early 
morning in January 2015. The team 
had practiced ammonia releases many 
times. What happened on the ISS that 
day was not a real ammonia leak, but 
rather a computer failure—one that 
had heretofore not been known as a 
possibility. The team had to figure 
out what was going on. However, 
the most critical actions—to save the 
crew and vehicle—were virtually 
reflexive. While the flight controllers 
and the flight director often lay awake 
at night hoping such a day will never 
come, they know that if it does, they 
will be prepared. 
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Thermal Control— 
the “Circulatory System 
of the International 
Space Station 




A picture of the International Space Station (ISS) showing the largest and most visible portions of the Thermal Control System: the radiator panels. Four white 
radiators project down in the photo, and provide dedicated cooling to the ISS Electrical Power System. Two sets of three larger radiators project upward in 
the image, and provide cooling to all the other systems on the ISS. Fluid lines loop through ISS systems, and the coolant within collects heat from computers, 
electronics, air conditioners, and other mechanical systems around the ISS. That heated coolant then flows through the radiators where the heat is rejected 
into space, and the coolant, returned to its starting temperature, runs though the same cycle again. 


Other chapters have explored the 
“brains” of the International Space 
Station (ISS), the “lungs” the ability 
to “see,”“hear”and “speak”and 
even how its energy is generated . 
Equally important is the “circulatory 
system” of the space station. As 
the ISS orbits the Earth, it spends 
roughly half of each orbit in daylight 
and half in darkness. Beyond the 
Earth’s atmosphere is a harsh thermal 
environment. When equipment in 
space is exposed to direct sunlight— 
without the protection of the Earth’s 
atmosphere—solar radiation can 
cause severe heating, thereby rapidly 
increasing temperatures up to 
150°C (302°F). When equipment is 


exposed to the vast darkness of space, 
temperatures plunge sometimes 
as deeply as -130°C (-202°F). The 
Thermal Control Systems (TCSs) 
of the ISS perform two important, 
but seemingly opposite, functions. 
Fluid systems both inside and outside 
the vehicle act as a circulatory 
system, picking up excess heat 
from around the vehicle and then 
rejecting that heat overboard, thus 
maintaining equipment at proper 
working temperatures. These fluid 
systems are called Active TCSs 
(ATCSs), and there are several 
variations of active thermal systems 
on the ISS. Conversely, heaters 
installed throughout the vehicle 


protect equipment from freezing in 
the deeply cold periods of darkness 
during each orbit. These heater 
systems are known as Passive TCSs 
(PTCSs), and such systems are used 
on almost every segment of the ISS. 
For many years over the course of its 
history, the ISS could experience both 
of these extremes simultaneously. 

In the early years of assembly, the 
ISS flew what was known as a solar 
inertial attitude (X-Perpendicular 
Out of Plane). The orientation of 
the vehicle was such that one side 
faced the sun throughout the daytime 
periods while the opposite side faced 
deep space. Therefore, the opposing 
sides of the ISS were exposed 
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to opposing thermal extremes 
throughout the daytime portion of 
each orbit (see Chapter 7). This 
attitude was necessary for dynamic 
stability and power generation but 
caused thermal stress on the vehicle. 
Portions of the ISS facing the Earth 
experienced a middle ground in this 
realm of extremes. The Earth radiates 
heat better than deep space while 
providing only a fraction of the heat 
of the sun, thus the portion of the ISS 
that faces Earth achieves a goldilocks 
middle-ground temperature of not 
too hot and not too cold. The thermal 
systems on the ISS were designed 
to protect it from these extreme 
thermal environments while keeping 
the astronauts in comfortable, shirt¬ 
sleeve surroundings. 

Beyond the extremes of space itself, 
the ISS also requires a cooling 
process to maintain its many systems 
at operational temperatures. As on 
Earth, electronics and machines 
generate heat. In the gravity 
environment on Earth, system 
designers frequently use convective 
heat transfer in designing cooling 
systems, where warm air rises and 
moves away from the equipment 
to remove heat from machines. 
Thermal systems on the ISS rely on 
conduction, where heat is transferred 
from one substance to another 
through direct contact to provide 
cooling to heat-generating equipment, 
followed by radiation of that heat into 
space. (See sidebar: Convection— 
Gravity’s Cooling Mechanism.) 

A particularly critical symbiosis 
exists among the Command and 
Data Handling, the Electrical Power 
System (EPS), and the TCS. The TCS 
is powered by the EPS, controlled by 
the software in Command and Data 
Handling and, in turn, cools both to 
keep them functioning. Every other 


Convection—Gravity’s Cooling Mechanism 

Of the three primary mechanisms of heat transfer—conduction, convection, 
and radiation —convection is intuitively understood by most people based on 
their experiences on Earth. Hot air rises through convection, taking heat with 
it. For example, when placing a hand above a hot cup of coffee, a person can 
feel the rising warmth as the coffee cools. Convective heat transfer occurs 
when a fluid (air would be a fluid in this instance) is heated and becomes less 
dense. In a gravity environment, a warmer, less-dense fluid rises through the 
cooler fluid above it because the less-dense fluid is “lighter” than the colder, 
denser fluid. This free convection is responsible for the weather patterns 
on Earth, the flight of hot air balloons, and the usefulness of old-fashioned 
radiators. Without gravity, however, air will get hot and expand but will stay 
exactly where it is. This occurs because things are not “light” or “heavy” 
when there is no gravity. Without gravity, hot air will not rise. On Earth, if a 
computer is generating a lot of heat, it can be placed on a table, uncovered, 
and free convection will allow the heat to float up and away, thus keeping the 
computer from overheating. Inside the ISS, that same computer left floating 
in the middle of a module would simply heat the air around it, creating a 
bubble of heat surrounding the computer. On the ISS, a little more effort is 
required to keep that computer from baking itself. A fan can be used to blow 
the hot air away from the computer (which is known as forced convection), 
but the heat is simply being moved around to some other pocket of air. The 
heat will need to be removed altogether or all the air in the ISS will eventually 
get too hot. Computers outside the ISS pose yet another challenge since, 
beyond gravity, the other important part of convection is the air that carries 
the heat away. Computers outside the ISS are not surrounded by air. They 
are in the vacuum of space; therefore, a fan cannot help with cooling. 
Convection is not possible without some type of gas such as air or a liquid. 
Conduction is the process in which heat is transferred from something that is 
warm to something that is cool through direct contact. The ISS systems use 
conduction to carry unwanted heat from objects such as computers into fluid 
systems, which then carry the heat away from the heat-generating equipment 
and send that warm fluid flow through radiators, using radiation to release 
that heat into space. 


system on the ISS is equally reliant on 
these three core systems in one way 
or another, creating an interconnected 
web of dependencies that have to be 
carefully managed in both normal 
operations and failure scenarios. 

The TCSs on the ISS are comprised 
of a number of subsystems, all 


working together to maintain the 
various structures and components of 
the space station at the temperatures 
required for operation and survival. 
Most of those systems arrived in 
orbit as part of modules or structures 
installed during ISS assembly 
missions of the Space Shuttle (see 
Introduction). One by one, each 
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subsystem was integrated into the 
whole as the station itself was built. 
As such, the story of the TCS on 
the ISS parallels the story of the 
ISS assembly. This chapter offers a 
review of each different subsystem as 
summarized here: 

. PTCSs 

■ Heaters 

■ Insulation 

■ Coatings 

. ATCSs 

■ General 

□ Pumps 

□ Heat exchangers 

□ Valves 

□ Accumulators and 
pressure systems 

■ External 

■ Internal 

The PTCSs arrived with the first 
and last pieces of the ISS, and every 
segment along the way, and are 
discussed first. The ATCSs, both the 
ammonia-based fluid systems and 
the water-based fluid systems, are 
discussed next, initially summarizing 
the generic features of all such 
systems. Ammonia-based systems 
are used on the exterior of the ISS 
to move heat to radiators and release 
it into space. These ammonia-based 
systems are called External TCSs 
(ETCSs) and are used in a number 
of distinct applications even though 
they are of similar design. Water- 
based systems are used on the 
interior of the ISS to collect all of 
the heat generated by activity on the 
ISS from computers, experiments, 
and crew members, and to carry it to 
the ETCSs to be radiated overboard. 
The water-based systems are known 
as Internal TCSs (ITCSs) and can 
be found in each module on the 
US Segment, always in similar yet 
unique configurations. 
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Passive Thermal Control 
Systems 

A portion of the PTCS was the first 
ISS thermal subsystem that was 
launched into orbit. In this context, 
passive means thermal systems 
that do not use pumps and cooling 
fluids. The most basic form of a 
passive thermal system is insulation, 
which provides the same function 
as putting on a coat. Multilayer 
insulation consists of layers of thin 
aluminum and white cloth, 3.2 to 
6.4 mm (0.125 to 0.25 in.) thick, 
that help trap heat. Another type of 
passive system is paint. To protect 
against the intense sunlight, areas 
may be painted white to reflect as 
much heating radiation as possible, 
or painted black to absorb heat to 
provide warmth. Heat pipes are used 
in several places on the outside of 
the ISS, usually to provide passive 
cooling of electronics mounted on 
the outside of the space station. 

A heat pipe is a hollow tube with 
ammonia inside. Several tubes will 
be aligned together such that one 
end of the pipes is in contact with 
the warm electronics, and the other 
end of the pipes is mounted a short 
distance away from the heat source. 
When the heat from the electronics 
is transferred to the ammonia in the 
tubes, the ammonia turns to vapor. 
When the ammonia vapor comes 
in contact with the cool end of the 
pipes, it releases the transferred heat 
and condenses back into a liquid, 
flowing back along the pipe to the 
warm end again to repeat the process. 
Heat pipes provide a simple and 
effective way to move heat away 
from electronics without the need 
for mechanisms that may require 
maintenance over time. 


The final passive thermal system uses 
small heaters to keep hardware warm. 
When the Node 1 and Pressurized 
Mating Adapter 1 modules launched 
in the payload bay of the Space 
Shuttle Endeavour on December 4, 
1998, they took with them the first 
sets of heaters installed on the inside 
of the shell on most ISS pressurized 
modules (see Chapter 3). These 
heaters were designed to protect 
the inside of pressurized structures 
from condensation. Condensation 
is possible on the inside due to the 
respiration of the astronauts. During 
pre-launch processing, each module 
of the ISS was pressurized with clean, 
dry air. On orbit, each module was 
exposed to slightly more humid air 
once it was attached to the station. In 
the same way water collects on the 
cold outer surface of a glass of ice 
water on a humid day on Earth, the 
water vapor in the air on the ISS is 
liable to condense on any especially 
cold surface. The dew point on the 
ISS (i.e., the temperature at which the 
water vapor in air will condense into 
liquid water) is usually kept in the 
6°C to 8°C (42°F to 46°F) range. The 
outer walls of the space station, being 
the coldest surfaces in the pressurized 
sections of the ISS, are prone to drop 
below those dew point temperatures; 
therefore, heater patches consisting 
of nickel chrome wire embedded 
in patches of silicon rubber are 
spaced around the pressure shell of 
most modules on the US Segment 
to ensure surface temperatures are 
warm enough to avoid water pooling. 
Several types of passive thermal 
systems are shown in Figure 1. 

Condensation on the ISS needs to 
be prevented for a couple of good 
reasons, beginning with safety 
concerns. Water allowed to collect 
as condensation on the walls of the 
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Figure 1 . Various examples of PTCS are seen in this photograph of the Z1 truss connection to the Laboratory Module. The silver-like anodized coating of the 
modules helps reflect sunlight. Heaters (not visible) are bonded to the interior side of the pressure shell to keep it from getting too cold. Fluid connectors are 
wrapped in multilayer insulation to keep the temperature of the fluids within operational ranges. 


space station could become free- 
floating water, which could cause 
irreparable damage if it came into 
contact with station electronics. 
Additionally, condensation can cause 
corrosion of metal structures in the 
form of rust. Corrosion can lead to 
small holes in the critical shell of the 
ISS or make the ISS more susceptible 
to structural fatigue under dynamic 
stresses that occur due to normal 
thermal cycling as the space station 
orbits the Earth or during propulsive 
events such as vehicle reboosts 
(see Chapters 7 and 8). 


Active Thermal Control 
Systems—General 

Passive systems are effective for 
keeping particular areas at the right 
temperature; however, sometimes 
large quantities of heat need to be 
moved from one area to another or 
removed from the system altogether. 
Active systems are required when heat 
needs to be moved from its source to 
a different location where it can be 
expelled. The ISS has three types of 
active thermal systems: one internal 
and two external. A third external was 
available temporarily. This section 
describes the common characteristics 
of these active systems. 


Every ATCS on the ISS is a closed- 
loop system, with fluid lines 
connecting heat “loads” (i.e., the 
equipment that needs to be cooled) 
to heat rejection points. This is 
exactly the same way a building or 
automobile air conditioner works. In 
an air conditioner, air moves over a 
tube filled with cold liquid so the heat 
transfers to the coolant. The now- 
warm liquid passes through tubes 
on the outside of the unit so that the 
heat can be absorbed by the outside 
air. In the ITCS, the heat loads are 
individual pieces of equipment such 
as computers, air conditioners, water 
processors, and experiments. Fluid 
lines pass close by these loads to 
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Interface 



Isolation Valve 


Figure 2. A schematic of an ATCS. Warm water (red) flow starts at the pump in the lower right of the diagram. Coolant passes into the IFHX where it will 
pass heat to the colder ammonia (blue then yellow) inside the heat exchanger. The now-cooled water (pink then blue) flows back to the loads to pick up 
more heat. The Three Way Mixing Valve (TWMV) is adjusted to regulate the temperature of the fluid going to the loads at the upper right of the diagram. 
Some warm fluid can be pulled directly into the TWMV, bypassing the heat exchanger, to make sure the fluid going to the loads is not too cold. On the 
left of the diagram, cold ammonia (light blue) comes into the heat exchanger from the radiators. Inside the heat exchanger, the ammonia picks up heat 
from the water such that it leaves the IFHX warmer (yellow) and returns to the external pump (not shown), which will push it back to the radiators again. 

A bypass valve will divert the flow of ammonia away from the heat exchanger when it is not being used. An isolation valve, in conjunction with the bypass 
valve, can be used to isolate the heat exchanger and prevent colder-than-normal ammonia from reaching the center of the heat exchanger. This might 
be needed during repair work, for example. The heat exchanger cannot be completely isolated from the ammonia side of the system due to the presence 
of what is known as a bleed line. When a heat exchanger is isolated, there is a risk that the ammonia remaining in the heat exchanger could get hot and 
increase in pressure. The bleed line provides a pressure relief capability, allowing ammonia to safely escape the heat exchanger if it heats up. The “M” in 
a circle over some valves indicates a manual override, which means an astronaut could adjust that valve if, for some reason, the computer control was 
not working properly. See also Figure 2 in Chapter 20. 


absorb some of the heat generated 
by the load, thereby warming the 
fluid. The point in an active thermal 
system where heat leaves the loop is 
referred to as the heat rejection point. 
The heat rejection point for the ITCS 
loops is an Interface Heat Exchanger 
(IFHX), which provides a connection 
point between the ITCS inside the 
ISS and the ETCS outside of the ISS 
(Figure 2). In a heat exchanger, a 
warm fluid passes by a colder fluid, 
thus allowing heat to be rejected 
from the hot side to the cold side. 

In the ETCS, the heat exchanger 


provides the heat load, and the heat 
rejection points for the ETCS are 
radiators that radiate heat into space. 
Pump hardware in each type of loop 
circulates the coolant (either water or 
ammonia) through the cooling loop. 
Each cooling loop has a number of 
sensors, valves, and controllers to 
maintain desired loop temperatures 
and monitor for problems in loop 
operation. The cooling loops inside 
and outside the ISS use many 
common components, but the 
details of how those components are 
designed or configured differs based 


on the specific needs of the cooling 
application, as discussed in the 
following sections. 

Each fluid loop on the ISS uses a 
Three Way Mixing Valve (TWMV) 
to control loop temperature, as shown 
in Figure 2. These three-way valves 
are similar to a single-handle faucet 
control at a kitchen sink. As with 
kitchen faucets, these three-way 
valves have two sources of liquid 
that are blended together into one 
outlet. One source of coolant flow at 
TWMV comes from the heat rejection 
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point in the loop and provides the 
coldest fluid in the loop. This source 
is comparable to the water coming 
from the water main into the kitchen. 
The second source comes from a 
line that bypassed the heat rejection 
point and is still warm. This source 
is similar to the water coming from 
the water heater, but instead of being 
intentionally warmed, it is warm 
from the heat loads on the ISS. The 
two sources are known as the return 
line and the bypass line, respectively, 
and the valve position determines 
how much of the warm bypass line 
coolant is added to the cold return 
line coolant in the outlet line. In 
the three external cooling loops, 
these valves are called Flow Control 
Valves (FCVs). Three-way valves are 
also used to provide control of loop 
pressure at some points in the ITCS, 
as will be discussed later in the ITCS 
section of this chapter. 

The active systems use one or 
more accumulators to manage loop 
pressures. Accumulators serve three 
purposes in ISS fluid loops: they 
allow for thermal contraction and 


expansion of the cooling fluid, ensure 
sufficient pressure at the inlet to each 
fluid system pump, and provide a 
small amount of makeup fluid in the 
event of a fluid leak. An accumulator 
is a small tank with a compressible 
metal bellows inside (Figure 3). A 
bellows is an accordion-like container 
that is able to expand and contract 
freely. On the ISS, the tank usually 
contains the cooling fluid and the 
bellows contains nitrogen at a desired 
pressure. Since the bellows is free to 
expand and contract, the pressure of 
the coolant will match the pressure of 
the nitrogen; therefore, the nitrogen 
pressure is used to control and 
maintain the pressure of an entire 
cooling loop, through the accumulator. 

After detailed engineering analysis, 
NASA chose ammonia as the coolant 
for the ATCSs on the exterior of the 
space station for several reasons: 
ammonia has a lower density 
than many other commercially 
available coolants and can therefore 
be launched in great quantity at 
dramatically reduced launch costs; 
it has a low viscosity so it requires 



Figure 3. The accumulator for the Pump Flow Control Subassembly is illustrated, but the other TCS 
accumulators work on the same principles. Fluid (in this case, ammonia) is in the tank surrounding the 
orange bellows, which can expand and contract. Nitrogen gas within the bellows provides pressure 
on the bellows, which in turn applies pressure to the ammonia to help ensure it can move around the 
system properly. 


little power for pumps to circulate 
the ammonia through cooling 
loops; and ammonia remains liquid 
down to -78°C (-108°F), which is 
important in the extreme cold of 
the ISS external environment. On 
the downside, ammonia is toxic to 
humans; therefore, the possibility 
of this dangerous chemical leaking 
into the pressurized cabin is one of 
the three major emergency responses 
discussed in Chapter 19. 

Active Thermal Control— 
External Thermal Cooling 
Systems 

The ETCS expanded significantly 
throughout construction of the space 
station, though the fundamental 
design of the system remained the 
same. These systems have been 
critical to human presence on the ISS. 
Without the ability to reject heat from 
the interior of the ISS overboard, 
the many systems inside the station 
cannot operate for long without the 
air becoming unbearably hot. The 
challenge during assembly of the ISS 
was that the large, permanent ETCS 
loops would not arrive until the latter 
half of the construction sequence. 

The ammonia loops arrived already 
integrated into the truss segments that 
make up the backbone of the ISS, 
providing structure and infrastructure 
for power to flow from the outboard 
solar arrays into the central core of 
the station. Many of the habitable 
modules of the ISS arrived years 
before the truss was completed, but 
they could not be fully activated until 
the permanent thermal and power 
systems arrived with the trusses. The 
assembly sequence was altered to 
provide one truss segment, P6, early 
in the sequence, with a pair of solar 
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arrays and two pairs of ammonia 
loops, thus providing power and 
cooling to the evolving space station 
much earlier than originally designed. 
This was done to expedite human 
presence on the ISS and begin the ISS 
research program. 

The P6 truss segment was outfitted 
with two cooling loops to provide 
cooling to the habitable modules, 
specifically to support the ITCS and 
allow for early activation of interior 
systems. The augmented P6 truss was 
installed on the zenith face of the ISS 
during STS-97/ISS-4A in late 2000, 
during the third ISS assembly flight 
of the Space Shuttle. The additional 
cooling loops were known as the 
Early External TCS (EETCS). Along 


with the 2B and 4B solar arrays 
and associated power channels, 
the EETCS allowed for a complete 
activation of the Laboratory Module 
(LAB) systems once the LAB was 
installed on STS-98/ISS-5A in 2001. 
See Figure 4. The P6 truss stayed 
in this location while the remainder 
of the ISS was built around it. The 
early external cooling system was 
deactivated with the arrival of the 
remaining truss segments in 2006 
and 2007 and the activation of 
the permanent ETCS. Ultimately, 
the P6 truss was relocated to its 
design location as an outboard truss 
segment, though not without incident 
(see Chapter 18). Power channels 2B 
and 4B and their associated cooling 
loops are again active; however, 


the EETCS is permanently retired, 
and provides spare parts for eight 
of the cooling loops on the ISS. 

The permanent system shares many 
common features with the EETCS, 
which would later play yet another 
role, as detailed in this chapter. 

The final configuration of the ISS 
includes two types of ETCSs. Loops 
A and B form a redundant pair 
of loops that provide cooling for 
the core of the ISS. Eight smaller 
ammonia loops, known as the 
Photovoltaic TCS (PVTCS), each 
service one channel of the electrical 
system, and are named for the power 
channel they support (e.g., PVTCS 
IB for the IB power channel). (See 
also Chapter 9.) 



Figure 4. Picture of the early space station after STS-98/ISS-5A. The P6 module with its set of arrays and the EETCS was temporarily attached to the Z1 truss. 
Two radiators labeled the trailing EETCS (since it pointed aft) and starboard (since it pointed starboard) provided cooling for the entire US On-orbit Segment. The 
Photovoltaic system on P6 has its own TCS called the Photovoltaic TCS with a forward-pointing radiator called simply the ‘PVR” (Photovoltaic Radiator), which 
provides cooling to electrical power generation and storage systems on the element. 
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External Thermal Control 
Systems—Temperature Control 

As mentioned earlier in the chapter, 
FCVs are the three-way valves 
that provide temperature control in 
external thermal loops on the ISS. In 
the ETCS, the FCV must maintain 
loop temperature within a fairly tight 
tolerance (around 4°C [39°F]) to 
provide ammonia sufficiently cold to 
draw heat from the heat exchanger, 
but also sufficiently warm to avoid 
freezing the water on the ITCS side 
of the heat exchanger. In comparison, 
the PVTCS FCV simply moves 
all the way to return flow (i.e., full 
cool, also known as “open”) if the 
ammonia from the EPS batteries is 
too warm, and then moves all the 
way to bypass flow (i.e., full hot, also 
known as “closed”) when ammonia 
from the EPS batteries is too cool. 
Thus, the FCV in the ETCS has much 
finer control algorithms than the one 
in the PVTCS. 

External Thermal Control 
Systems—Pumps and 
Accumulators 

In a PVTCS, the pump is within the 
Pump and Flow Control Subassembly 
(PFCS), which provides ammonia 
circulation and control of the loop 
temperature and pressure. The PFCS 
contains the following: two pumps; 
the FCV to control loop temperature; 
a fluid accumulator to control loop 
pressure; a suite of sensors to monitor 
temperature, pressure, flow, and 
ammonia quantity; and an electronics 
unit to control all mechanisms on the 
loop. See Figure 5. 

The accumulators serve two purposes 
in the PVTCS. Since ammonia is 
incompressible, rapid heating causes 
the fluid to expand quickly. If there 
is no method to accommodate that 



Figure 5. A simplified schematic of the Photovoltaic Thermal Control System. Redundant pumps (green) 
push cool ammonia (blue) to the electrical power generation and storage systems. The electrical systems 
are cooled by the ammonia absorbing the heat (red). The warm ammonia passes through a radiator 
where the heat is transmitted to space. The cooled ammonia (blue) returns to the Pump and Flow Control 
Subassembly to repeat the cycle. An accumulator maintains the pressure on the fluid line when the liquid 
expands or contracts as temperatures vary during an orbit around the Earth and throughout the year. A 
flow control valve allows mixing of warm and cool fluid to adjust the temperature of the loop. 


expansion, line pressures can quickly 
exceed the capacity of the fluid 
lines, which leads to burst lines. 

This is of particular concern in the 
PVTCSs, which were filled with 
ammonia coolant when launched, 
and were exposed to extreme thermal 
environments once they reached orbit 
but before they were activated. The 
first purpose is to provide room for 
ammonia to expand when it gets hot. 
The second purpose is to provide 
ammonia to compensate for a small 
amount of leakage from the system 
over time. 

The PFCS pumps in the PVTCS 
and the EETCS are run by a three- 
phase 120 volts (direct current) 
brushless pump motor and were 
set to operate at 13,580 revolutions 


per minute (rpm) to provide an 
average ammonia flow rate of 
862 kg/hr (1900 lb/hr). The PVTCS 
are comparatively small and simple 
loops, with fairly short lines and no 
parallel flow paths, thus requiring 
much less pumping power than 
would ultimately be needed for 
the much larger and more complex 
ETCS. By comparison, the ETCS 
pump provides an average flow rate 
of between 3175 and 4309 kg/hr 
(7000 and 9500 lb/hr). The ETCS 
pump capacity is discussed later 
in this chapter. Each PVTCS and 
EETCS loop contains two identical 
pumps in case one fails. However, 
there is only one FCV per loop, 
since valves are generally more 
reliable than pumps. 
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Figure 6. A simplified schematic showing the major components and flow paths of the External Thermal Control System (ETCS). The ETCS is very similar to 
the Photovoltaic Thermal Control System shown in Figure 5. Starting in the pump module, a pump (green) pushes cool ammonia (blue) to either the electrical 
distribution systems on the exterior of the ISS or heat exchangers on the habitable modules where heat is picked up from the Internal Thermal Control System 
(discussed below and shown in Figure 10). The warm ammonia (red) passes through a rotating mechanism called the Thermal Radiator Rotator Joint to 
radiators where the heat is transmitted to space. The cooled ammonia (blue) returns to the pump module to repeat the cycle. A flow control valve in the pump 
module allows mixing of warm and cool fluid to adjust the temperature of the loop. An Ammonia Tank Assembly (ATA) performs the role of an accumulator, 
maintaining the pressure on the fluid line as the liquid expands or contracts through the orbit or year. Unlike the PVTCS, the ETCS has a replenishable 
nitrogen tank to maintain pressure at the AT A. A fixed-pressure accumulator in the pump module is too small to maintain loop pressures year round, but can 
maintain stable pressure for short periods if theATA/NTA combination is unavailable. 


The ETCS pump is located within an 
assembly called the pump module, 
which consists of a Pump and Control 
Valve Package, an accumulator, 
several valves, and a suite of sensors 
to monitor temperature, pressure, flow 
rate, and ammonia quantity (Figure 6). 
The pump and control valve package 
contains a pump, an FCV, sensors to 
monitor temperature and flow rate, 
and a firmware controller to control 
the pump and FCV. Each ETCS loop 
has one pump module, located in 


the S1 truss segment for Eoop A and 
the PI truss segment for Eoop B. In 
August 2010 and December 2013, 
the pump module on Loop A failed, 
cutting off half the cooling and 
leaving the station one failure away 
(on Loop B) from losing all cooling. 
Without cooling, the equipment would 
overheat and ultimately fail. Since 
most of the critical systems have two 
identical instances to provide for 
redundancy, the failure of one loop 
meant half of these systems had to be 


shut down. If the other loop failed, 
or if any of the redundant equipment 
that it cooled broke, the station would 
no longer be viable for supporting 
the crew. The crew conducted three 
emergency spacewalks later that 
month to restore functionality (See 
Chapter 20). 

As with the PVTCS, the accumulator 
in the pump module accommodates 
thermal expansion and contraction 
of ammonia within the pump 
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module when the ETCS is dormant. 
Pressure control of the ETCS loops 
during operation is provided by a 
combination of a Nitrogen Tank 
Assembly (NTA) and an Ammonia 
Tank Assembly (ATA), which 
together act as a large ammonia 
accumulator for each ETCS Loop. 

The ETCS contains 118 L (31 gal.) 
in each of two loops. As mentioned 
above, any segment of fluid line filled 
with ammonia must have access to 
a pressure relief mechanism, usually 
an accumulator or a mechanical 
pressure relief valve, to ensure that 
rapid ammonia temperature increases 
do not cause overpressurization, 
which could burst lines. Because the 
ETCS loops were launched to orbit 
in many sections across several flight 
elements, each section was filled 
with nitrogen rather than ammonia. 
Using inert nitrogen, which does not 
respond to temperature extremes with 
the same pressure changes to which 
ammonia is susceptible, prevented 
the need for additional accumulators 
throughout the system. Once the 
entire system had been assembled 
on the ISS in 2006, the nitrogen was 
vented and the system was filled with 
ammonia just prior to activation. This 
strategy allowed all of the ammonia 
to be contained in a set of ammonia 
tanks for launch and installation; 
therefore, the cost of overpressure 
protection was limited to the design 
of those ammonia tanks, which were 
then incorporated into the ETCS as 
part of the ATA. 

The ATA is a box that measures 
approximately 175x 102 x 137 cm 
(69 x 40 x 54 in.). The box consists 
of the following: two ammonia tanks; 
an isolation valve for each tank; 
pressure, temperature, and quantity 
sensors for each tank; the plumbing 


needed to connect the ATA to the 
rest of the ETCS; and a vent valve 
on a line connected to both tanks. 
Each ATA holds 397 L (105 gal.) of 
ammonia. Each of the ATA ammonia 
tanks includes a bellows filled with 
pressurized nitrogen, such that each 
tank is able to act as an accumulator, 
accommodating thermal expansion 
and contraction of the ammonia, 
pressurizing the loop for optimal 
pump performance, and providing 
ammonia to make up for leakage 
over time. The nitrogen side of the 
ATA is connected to the NTA, a 
box that measures approximately 
152 x 91 x 76 cm (60 x 36 x 30 in.) 
and consists of a nitrogen tank, 
pressure and temperature sensors, 
a Gas Pressure Regulating Valve 
(GPRV), and two isolation valves. 
The plumbing in the NTA connects 
the nitrogen tank to the GPRV. The 
plumbing then splits into two lines 
(one connecting to each tank in the 
ATA), each with an isolation valve 
that can cut off the NTA from the 
associated ATA tank. 

The PVTCS accumulators have a 
fixed charge of nitrogen that cannot 
be changed or replenished, whereas 
the nitrogen pressure in the ATA can 
be adjusted using the GPRV in the 
NTA. The GPRV is a combination of 
four separate valves that can be used 
to increase or decrease the pressure 
of the nitrogen that is fed to the ATA 
tanks. Therefore, the GPRV is used to 
add or remove nitrogen to increase or 
decrease, respectively, the pressure in 
the ammonia lines as needed. 

Whereas the EETCS was a temporary 
and fairly simple system with pumps 
that operated at a fixed speed, the 
ETCS pump operates at variable 
speeds so that its capability could 
be adjusted as additional lines were 


added to the system over time. 

When the ETCS was first activated, 
it connected only to the heat 
exchangers on the LAB. Over time, 
as additional modules were added 
to the ISS, additional ETCS lines 
were added to provide access to the 
heat exchangers on those modules, 
which required additional capability 
from the pump. The ETCS pumps 
can operate between 11,250 and 
18,000 rpm, as required to provide 
a system flow rate of 3,719 to 
4,037 kg/hr (8200 to 8900 lb/hr). 

External Thermal Control 
Systems—Heat Exchangers 

As seen in Figure 2, an IFHX is 
an assembly that consists of a heat 
exchanger core, two valves, three 
heaters with associated temperature 
sensors (not shown), and four fluid 
connectors to connect the heat 
exchanger to water inlet and outlet 
lines and ammonia inlet and outlet 
lines. The heat exchanger core uses 
a counterflow configuration, with 
ammonia and water that flow in 
opposite directions in adjacent layers. 
Each layer uses a ruffled fin material 
(i.e., stainless steel for the ammonia 
layers and nickel for the water layers) 
separated by a stainless steel parting 
sheet to keep the fluids separated. 

The ruffled fins help hold the parting 
sheets together and provide additional 
surface area to increase heat transfer. 
There are two heat exchanger core 
configurations: one rated to transfer 
up to 14 kW of heat; the other rated 
for up to 12 kW of heat transfer. Of 
the 10 heat exchangers on the ISS, 
eight are the 14 kW design and two 
are the 12 kW design. Chapter 4 
discusses some of the challenges of 
working with the heat exchanger units 
on the Node 3 module. 
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The three-way valve in the heat 
exchanger assembly provides the 
ability to divert ammonia flow such 
that it bypasses the heat exchanger 
core. This valve is called a bypass 
valve (Figure 2). When the ETCS 
loop is off, this valve is adjusted to 
allow the ammonia flow to bypass 
the heat exchanger so that when 
the loop starts up, the super-cold 
ammonia will not be able to remove 
too much heat from the internal 
system. Although it sounds desirable 
to reject as much heat as possible, 
there is a point where things can get 
too cold. Because water expands as 
it freezes, the heat exchanger is not 
allowed to reach the freezing point 
of water. Otherwise, the frozen water 
will expand such that it ruptures the 
stainless steel parting sheet and then 
contracts as it thaws, leaving a hole 
for ammonia to leak through and 
into the cabin. An Isolation Valve—a 
two-way (i.e., two-position) valve 
that can be closed to isolate the heat 
exchanger core from ammonia flow— 
helps prevent the water from freezing 
in the IFHX. The ETCS ammonia 
is kept at a temperature of about 
3.3°C (~37.9°F). If the temperature 
drops below that level, software in 
the system will automatically stop 
ammonia flow and configure these 
valves to bypass and isolate the 
ammonia side of the IFHX. When 
a heat exchanger is bypassed and 
isolated, it is hydraulically locked 
such that any sudden temperature 
increases within the ammonia will 
put the heat exchanger at risk of 
overpressurization. As another check 
to prevent overpressurization, the 
heat exchanger has a small ammonia 
fluid line, called a bleed line, which 
connects the ammonia inlet close 
to the heat exchanger core with the 
ammonia outlet outside the isolation 
valve. Some ammonia can escape 


through this line if pressure gets too 
high inside the isolated IFHX core. 

Heaters attached to the heat 
exchanger core and the water inlet 
and outlet lines are designed to 
prevent freezing of the water side 
of the heat exchanger. Additional 
safety checks in the ETCS software 
help detect issues and prevent the 
heat exchanger from freezing. The 
first response was detailed above: if 
the ammonia temperature drops to 
about 1.1 °C (34°F), the ETCS pump 
will automatically shut down and the 
heat exchanger will be bypassed and 
isolated to prevent cold ammonia 
from entering the heat exchanger. The 
second and third checks monitor the 
quantity of fluid in the internal system 
pump accumulator. If the quantity of 
water measured in the accumulator 
begins to rise, the only source of 
fluid would be ammonia leaking 
into the water. Therefore, if the 
accumulator quantities in the ITCS 
go above a threshold, the pumps will 
be shut down to help prevent pushing 
ammonia into the cabin. As discussed 
in Chapter 19, the case of toxic 
ammonia leaking into the crew cabin 
is one of the three critical emergency 
events for which the crew and ground 
regularly train (see also Chapter 10). 

External Thermal Control Systems — 
Loads and Radiators 

The final component included in all 
the external thermal systems is the 
heat rejection point: the radiators. 
Although there are two types of 
radiators, they work the same way by 
providing radiative heat transfer from 
ammonia loops on the ISS. One type 
is known as a Photo Voltaic Radiator 
(PVR), which is installed in the eight 
PVTCSs. The second type is known 
as the Heat Rejection Subsystem 
(HRS) or, more commonly, the ETCS 


radiators. Both types of radiators 
consist of a base panel connected to a 
series of radiator panels that are hinged 
together, accordion-style, such that 
they can be deployed (i.e., straightened 
out, end to end) or retracted (folded 
back together, face to face) (Figure 7). 
Each radiator was fully retracted at 
launch and has an automated deploy/ 
retract capability with a manual 
override that can be controlled by a 
spacewalking astronaut. 

The P6 truss segment houses a total 
of three radiators. One radiator, 
known simply as the 2B/4B PVR, 
faced forward to be shared between 
the two PVTCS loops. The remaining 
two radiators were shared between 
the two EETCS loops. One radiator 
faced aft and therefore is still known 
as the Trailing Thermal Control 
Radiator (TTCR). The other radiator 
faced starboard in the original 
P6 location, and is known as the 
Starboard Thermal Control Radiator. 
Note: Now that the outboard truss 
segments rotate 360° to support 
solar array pointing, neither name is 
accurate. See also Figure 4. 

The PVR radiator type is always 
shared between two independent 
loops and has seven radiator panels. 
The seven panels together can reject 
from 9.5 to 14 kW of heat, depending 
on the thermal environment. This 
is equivalent to the capacity of the 
air conditioner in an average house 
in the southern United States. The 
inside of each radiator panel is a 
honeycomb made from aluminum 
sheeting, with that honeycomb 
sandwiched between two 0.254 mm 
(0.010 in.) sheets of aluminum that 
are then coated with either silver 
or white coating to ensure optimal 
reflectivity. Each panel has 24 
stainless steel tubes that measure 
0.17 cm (0.067 in.)—12 tubes for 
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Figure 7. Deployment of the Photovoltaic 
Radiator on the P3 truss during STS-115/ISS- 
12A in September 2006. The sequence from top 
to bottom shows the radiator unfolding from the 
compact launch configuration to its fully extended 
length, approximately 12.53 m (-493.4 in.). 

Each of the seven radiator panels is approximately 
3.12 x 1.79x 0.02 m (~ 124 x 70.6 x 0.69 in.), 
or about the size of two queen-sized mattresses 
placed next to one another. 


each of the two loops sharing the 
radiator—to carry ammonia across 
the radiator panel. Ammonia flows 
down one side of a PVR/TCR 
radiator through the tubes running 
through the panels and then back 
up tubes on the opposite end of the 
panels. The tubes along the ends of 
the panels are connected from one 
panel to the next with flexible hoses 
where the panels hinge together so 
that ammonia can get all the way to 
the last panel. Heat from the warm 
ammonia radiates into the coldness 
of space as the fluid moves along the 
large radiator panels. 

In the EETCS, ammonia flowed 
from the PFCS through the P6 lines 
to Zl, through the Z1 lines to the aft 
end of the LAB where it joined the 
fluid lines on the LAB Aft Endcone, 
and through the heat exchanger to 
collect heat. The warmed ammonia 
then flowed back through Zl and 
P6, this time all the way up to the 
radiators. The flow from each EETCS 
loop split, some flowing through the 
TTCR and some flowing through 
the Starboard Thermal Control 
Radiator. Some of the flow bypassed 
both of the radiators to provide 
warm ammonia to the FCV in the 
PFCS, which performed temperature 
regulation. Most flow from the 
heat exchanger flowed through the 
radiators to provide cold ammonia 
to the FCV, which then merged the 
warm and cold ammonia to achieve 
the desired temperature for ammonia 
to return to the pump, where it started 
the journey again. 

The PVTCS follows the same basic 
path, except that all heat loads are 
contained on one truss so the loops 
never leave that truss segment. 
Ammonia flows from the PFCS to the 
batteries and other control equipment 


that require cooling, then both 
PVTCS loops flow through the single 
PVR to the PFCS. If the electrical 
equipment is cool enough to not 
require cooling at that moment, the 
FCV flow will bypass the radiators 
and go directly to the pump where it 
starts the loop again. 

The ETCS radiators are functionally 
the same as the EETCS/PVTCS 
radiators, though far larger and 
somewhat more complex. Each 
Heat Rejection System radiator 
has eight panels, each measuring 
3.4 x 2.7 m (131.25 x 107.00 in.), 
or a bit bigger than two king-size 
mattresses placed side by side. 
Together, the eight panels that make 
up one HRS radiator can reject up 
to 11.67 kW. The HRS radiator 
panels are built in much the same 
way as PVR types. Ammonia flows 
through the radiators the same way, 
though the HRS panels have only 
22 stainless steel tubes to carry 
ammonia across the radiator with 
each tube—about double the size of 
those in the PVR radiators at 0.32 cm 
(0.13 in.) in diameter. Each HRS 
radiator is used by only one ETCS 
loop, but each has two independent 
flow paths, thus allowing some 
flexibility of cooling capability. The 
22 tubes that run across each radiator 
panel are distributed between the 
two independent flow paths in an 
alternating pattern. Each ETCS loop 
has three HRS radiators installed 
side by side on a large rotating 
plate called a Radiator Beam Truss 
Structure, as shown in Figure 8. 

Three radiators provide a total of six 
radiator flow paths for a combined 
heat rejection capability of up to 
35 kW for each ETCS loop. The 
radiator flow paths were filled with 
nitrogen for launch and installation, 
and the cooling capability has proven 
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Figure 8. A major component of the ETCS as seen from the Space Shuttle. The left image shows the port and starboard radiator beams (three radiators per 
beam, with each radiator consisting of eight panels). On the right is a close-up of the Radiator Beam Truss Structure that is rotated by the Thermal Radiator 
Rotary Joint to maximize heat rejection. 


greater than the need. Therefore, 
some of the flow paths still have their 
original nitrogen fill and have not yet 
been used. 

Though the EETCS radiators on 
the P6 truss were fixed, each set of 
ETCS radiators can be rotated to 
improve heat rejection by positioning 
the radiator beam so that its three 
radiators are in an edge-to-sun 
position. This rotation is accomplished 
via the Thermal Radiator Rotary 
Joint (TRRJ) (Figure 8), which uses 
many of the same components as 
the Solar Array Rotary Joint (S ARJ) 
described in Chapter 9. As with the 
SARJ, the TRRJ consists of a pair 
of drive/lock assemblies and a pair 
of rotary joint motor controllers 
(see Chapter 9). Unlike the SARJ, 
the TRRJ has a limited rotational 
capability because it is impractical to 


use fluid connectors that have a full 
360 degrees of rotation. Instead, the 
fluid hose rotary coupler provides 
fluid connections from one end 
of the TRRJ to the other, and the 
hoses within the fluid hose rotary 
coupler limit rotation to 210 total 
degrees of rotation, 105 degrees in 
each direction. The TRRJ interface 
is also much smaller than the SARJ 
interface. Whereas the SARJ rings 
are as large as the truss segment that 
houses it (i.e., large enough for a 
person to stand inside), the TRRJ is 
a fairly compact cylinder installed 
in the center of the SI and PI truss 
segments. Also, unlike the SARJ, 
the TRRJ generally does not need to 
rotate very much and can be left in 
the same position, changing only for 
specific attitude changes or certain 
solar beta angles (see Chapter 7). 

Figure 9. A schematic 
showing how a coldplate 
works. Cold liquid 
flows in from the left 
side and picks up 
heat generated by the 
attached hardware. The 
warmed liquid then flows 
out toward the radiators. 


The primary purpose of all three 
external systems is to cool the 
heat exchangers that provide heat 
transfer from pressurized modules. 
However, the ETCS also supports 
several EPS components that are 
located on the truss segments. These 
electrical components are mounted 
on an interface known as a coldplate, 
which both connects the component 
to the truss and provides an interface 
for ETCS cooling (Figure 9). Each 
coldplate is a broad plate with narrow- 
set fins extending from it. Those fins 
interleave with fins extending from 
the electrical component such that 
heat from the electrical component 
fins radiates to the coldplate fins. This 
finned plate is bonded to a stainless 
steel flow plate, which is sealed to 
allow ammonia flow through the unit 
to pick up heat transferred through 
the aluminum fins. Each ETCS loop 
provides cooling to five electrical 
components in addition to five heat 
exchangers. Though the heat load from 
the electrical components is a small 
fraction of the heat load from the heat 
exchanger, the electrical components 
are fully dependent on ETCS cooling 
to function at full capacity. 
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When the International Space Station 
Needed a Plumber 

In 2004, the 2B PVTCS developed a small leak. The leak was slow 
enough that it was tolerated. However, in 2012, the rate of leakage greatly 
accelerated and it was possibly increasing exponentially fast. At that rate, 
the loop would exhaust its ammonia supply fairly quickly. Fortunately, a 
spare, dormant system—the EETCS—was available. The operations team 
quickly developed a contingency spacewalk to replumb the ammonia 
flow from 2B through the TTCR of the EETCS. This was accomplished 
during an extravehicular activity (EVA) when the crew put in two fluid line 
hoses to connect the two systems. The TTCR had been retracted after it 
had been decommissioned, so it also had to be redeployed manually by 
the spacewalking astronauts. Although this did not stop the leak, it did 
show that the leak was not due to a hole in any of the myriad little tubes 
inside the radiator panel, which would be extremely hard to repair, if at all. 

In May 2013, the rate had again increased when ISS Commander Chris 
Hadfield noticed ice flakes coming from the port truss while performing an 
EVA. At the new rate, the loop would potentially be unable to sustain cooling 
in 24 to 48 hours. Once again, the operations team quickly put together a 
spacewalk within 48 hours to replace the pump assembly, which ultimately 
fixed the leaking system. In November 2015, the jumpers were removed and 
the cooling system returned to its nominal configuration. In a follow-on EVA 
in August 2016, the TTCR was retracted again and returned to a dormant 
storage configuration until it may be needed in the future. 


Active Thermal Control— 
Internal Cooling Loops 

The equipment in the various ISS 
pressurized modules is cooled by 
the ITCSs, which function similarly 
to the external systems. Each major 
module—LAB, Node 2, Node 3, 
Japanese Experiment Module, and 
Columbus Module—has a separate 
ITCS. Equipment in the airlock 
is cooled by the LAB ITCS. The 
internal cooling system in each 
of these modules performs the 
same function and has roughly the 
same design even though there are 
differences in each module due 
mainly to differing needs, but also 
because of slightly different design 
approaches among the contractors 
who provided the systems. This 
section will focus on the LAB ITCS 
as an illustration of the ISS ITCS, 
then touch on the differences among 
the systems in the different modules. 
Water is used in the loops inside the 
ISS; ammonia is used in the cooling 
loops external to the ISS. Since water 
provides high thermal capacity (i.e., it 
is able to absorb a great deal of heat) 
with low viscosity (i.e., flows easily 
without requiring powerful pumps) 
and is not harmful to humans, it was 
a straightforward choice for internal 
cooling systems that operate at 
moderate temperatures. 

The LAB ITCS, shown in Figure 10, 
is a water loop system that can 
be configured as two independent 
loops or as one combined loop, thus 
providing redundancy and flexibility 
in operations. When configured as 
two separate loops, each loop has a 
pump assembly, a number of valves, 
and water lines passing through the 
LAB pressure shell to reach the IFHX 
where heat is passed from the ITCS 
to the external system. In each loop 


configuration, warm water flows 
through the pump and is then sent 
to the heat exchangers for cooling. 
The cooled water flow then splits 
across many parallel paths to reach 
the equipment in racks throughout the 
module, is warmed by that equipment 
using coldplates, and returns to the 
pump to start the circuit again. Along 
that circular path, valves control how 
much water flows through different 
paths, thereby controlling loop and 
equipment temperatures and loop 
pressures. The ITCS has only three 
types of valves, though valves of 
the same type serve several different 
functions throughout each loop. 

Each of the independent loops has a 


three-way valve that moderates flow 
between the racks of equipment that 
need cooling, and a line that bypasses 
those racks. This valve, called the 
System Flow Control Assembly 
Modulation Valve, provides a 
constant differential pressure across 
the system. Each loop also contains a 
pump shutoff valve that provides the 
ability to isolate a pump from water 
flow when the pump is not in use. 
Each loop also has a three-way valve 
controlling the water flow through 
a heat exchanger, thus controlling 
the temperature of the loop (i.e., 
more flow to the heat exchanger for 
a colder loop, less flow to the heat 
exchanger for a warmer loop). A unit 
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called the Nitrogen Introduction 
Assembly contains two separate 
two-way valves used to control loop 
pressure at the pump. The first, called 
the Nitrogen Introduction Assembly 
Introduction Valve, provides access to 
the ISS nitrogen system to maintain 
or increase the loop pressure via an 
accumulator in the pump package 
of each loop. The other, called the 
Nitrogen Introduction Assembly Vent 
Valve, allows the nitrogen in each 
ITCS accumulator to be vented into 
the cabin to reduce loop pressure. 

The two ITCS loops in the LAB 
operate at different temperatures to 
support different cooling needs in 
various systems. The colder of the 
two, known as the Low Temperature 
Loop (LTL), operates at 9.4°C 
(48.9°F) whereas the Moderate 
Temperature Loop (MTL) operates 
at 17.2°C (63.0°F). These control 
temperatures are optimized for 
the cooling of different equipment 
in the LAB, but each TWMV is 
capable of controlling to a broad 
range of temperatures, limited by 
the capability of the heat exchanger 
that is providing the cooling and 
the heat provided by the equipment 
being cooled. The LTL services 
mostly the environmental and 
life support systems equipment 
and payload racks that require 
cooling to lower temperatures. 

The MTL services mostly avionics 
and electronics across a variety of 
systems. The dew point on the ISS 
is kept in the 8°C to 10°C (46°F to 
50°F) range, meaning that water 
will condense on any surface colder 
than those temperatures. For that 
reason, the LTL lines are covered 
in thick insulation to prevent any 
moisture collection. Since the MTL 
operates at temperatures above the 
dew point, the MTL fluid lines are 
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Figure 10. Schematic of the LAB Internal Thermal Control System. In the LTL, cold water (dark blue) 
comes out of the IFHX and, if needed to adjust the temperature, mixes with warm water (purple) at 
the TWMV. The adjusted water flows to the heat loads. It returns through the System Flow Control 
Assembly, which regulates flow through the loads and the flow bypassing the loads to ensure steady 
flow rates throughout the system. After leaving the System Flow Control Assembly, flow proceeds 
via the Pump Package Assembly to the heat exchanger to reject the heat that the water has picked 
up. The MTL behaves the same way, cooling hardware that operates at higher temperatures. In 
contingency cases, the Loop Crossover Assembly can be opened between the loops to create one 
big loop using only one of the two Pump Package Assemblies. In the big loop configuration, the 
Regenerative TWMV allows warm water at the outlet of the MTL pump to warm the water flowing 
toward the MTL heat loads to ensure the MTL coolant is at the right temperature for the warmer 
loads. Not all modules in the US On-orbit Segment have crossover assemblies. 


uninsulated. A pair of 8-port valves, 
together called the Loop Crossover 
Assembly, allow the two ITCS loops 
to be connected in series such that 
one pump can provide flow to a 
single, larger loop. This mode can 
be used if there is a problem with 
one of the pumps. In the single loop 
configuration, water flows through 
the LTL loads and then through the 
MTL loads. The water temperature 
at the outlet of the LTL loads is not 
usually warm enough to ensure that 
the fluid lines will remain above the 
ISS dew point; therefore, the water 
must be warmed before flowing 
into uninsulated MTL fluid lines. A 
water-to-water heat exchanger, called 
the Regenerative Heat Exchanger, 
transfers heat from the warmest water 


in the system at the outlet of the 
MTL, to the cooler water at the outlet 
of the LTL to ensure water moving 
from the LTL lines to the uninsulated 
MTL lines is warmer than the ISS 
dew point. A three-way valve known 
as the Regenerative TWMV controls 
how much of the warmest MTL water 
passes through the Regenerative Heat 
Exchanger to control the resultant 
temperature of the water flowing out 
of the LTL and into the MTL. In the 
first years of LAB ITCS operation, 
the system was run as two separate 
loops, known as the dual-loop 
configuration. After an MTL pump 
failure in 2003, the ISS thermal 
community decided to preserve 
operational life on all remaining 
pumps by operating the ITCS in the 
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single-loop configuration. Operating 
in this fashion means only one pump 
is running at a given time, and is 
therefore experiencing wear and tear. 

Heat is removed from some of the 
hardware using coldplates, as shown 
in Figure 9. A rack can house several 
coldplates, in which case the whole 
rack is treated as one heat load 
with a rack FCV that functions in 
the same way as TWMVs to allow 
for temperatures to be adjusted, 
depending on the need of what is in 
the rack (Figure 10). 

Conclusion 

The thermal environment of space 
is extremely challenging to manage. 
The ISS has multiple thermal systems 
to help keep the space station from 
getting too hot or too cold. The 
systems employed on the ISS are 
actually similar to those used in 
terrestrial buildings. Fiberglass 
insulation in the walls or paint on 
a house are examples of passive 
thermal systems used every day. 
Heaters are also employed on the 
station and in the home to prevent 
areas from getting too cold. Most 
buildings and homes in hot climates 
have air conditioning, where heat 
is transferred to a fluid that, in turn, 
is radiated outside of the vehicle 
or building. One major difference 
exists between terrestrial heating and 
cooling systems and those employed 
on the ISS: when an air conditioner 
on Earth fails, a repairman can 
order parts and come fix it. When 
cooling fails on the ISS, every other 
system—from power generation, to 
computer controls, to the astronauts 
themselves—are put in jeopardy. 

Only the materials that are already 
in space can be used to make the 


repair. In the end, the ultimate goal 
of both Earth-based systems and the 
ISS thermal systems is the same: 
to keep the structure and occupants 
safe and comfortable inside. The 
engineering challenge with the ISS 
was to have a thermal system that 
worked in the extremes of the space 
environment, worked with the first 
elements of the ISS, and was able 
to adapt as the structure grew and 
matured. The flight control team 
carefully watches and manages the 
various cooling loops as the heat 
loads (e.g., different experiments 
or numbers of astronauts) vary and 
as the space station orbit changes 
(e.g., when the beta angle gets above 
60 degrees). The flight control team 
has also had to deal with significant 
failures in the system, such as when 
the pump that controlled ETCS 
Loop A failed, essentially removing 
half of the ISS-critical systems. Or 
when the FCV in the ETCS failed, 
which removed the ground’s ability 
to control the loop temperature and 
thus provide adequate cooling to 
other ISS systems. Any number of 
failures elsewhere on the ISS could 
have meant the loss of the crew 
or spacecraft (for more details, 
see Chapter 20). As with so many 
aspects of life in space, something 
taken for granted most of the time 
on Earth requires thoughtful design 
and focused attention to detail in 
operation to enable humans to live 
in the utter darkness and extreme 
brilliance of space. 


SYSTEMS: THERMAL CONTROL-THE “CIRCULATORY SYSTEM” OF THE INTERNATIONAL SPACE STATION 


CHAPTER 11 


207 




Chapter 12 Day in the Life: 

Empty House— 
Decrewing 
the International 
Space Station 




As discussed in other chapters , 
the international Space Station 
(ISS) was largely designed to 
be controlled by operators from 
the ground . This would allow 
crew members to focus their time 
on scientific research and not the 
“humdrum” daily activities required 
to keep the scientific laboratory 
running. However, many tasks require 
crew insight and hands-on actions, 
especially in the cases of repairing 
failed equipment and responding to 
emergency events. 

What would it mean if, for some 
reason, all of the ISS crew members 
needed to return to Earth? Would all 
scientific research stop? Could the ISS 
even survive without a crew, and for 


how long? In August 2011, the ISS 
Program was asked these questions. 

On August 24, 2011, the Progress 
vehicle number 44P (i.e., the 44th 
Progress resupply vehicle in the ISS 
Program) was lost due to a problem 
in the engine of the Soyuz U rocket’s 
third stage. Although the loss of 
supplies being carried on a supply 
vehicle, such as Progress, would 
impact operations, the ISS Program 
continuously plans consumables to 
overcome the loss of at least one 
resupply mission (see also Chapters 1 
and 14). The bigger impact to this 
loss was the similarity of the third 
stage of the Soyuz U rocket used 
to launch Progress cargo vehicles 
and the third stage of the Soyuz FG 


rocket used to launch Soyuz crewed 
vehicles. Immediately following 
the Soyuz U third stage failure, 
Roscosmos State Corporation for 
Space Activities—the government 
body that oversees Russia’s space 
program—started an investigation 
into the cause. However, it was 
unknown how long the investigation 
would last and whether any corrective 
actions would need to be taken on the 
Soyuz U and Soyuz FG rockets. 

Until the Soyuz U third stage 
failure was understood, the safety 
of launching new crews remained 
unclear. The crew on board the ISS 
was safe. However, Soyuz return 
vehicles have a limited lifetime. This 
presented the potential of needing to 
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return the current crew to Earth prior 
to the arrival of a new crew, thus 
decrewing the ISS and leaving it an 
empty house. 

The ISS Program and operators 
around the world began a thorough, 
time-limited review of space 
station operations to determine any 
changes to vehicle configuration or 
ground systems needed to keep the 
ISS operational during a potential 
decrewing of unknown duration. 
This chapter outlines the history of 
potential ISS decrewing discussions, 
how the 2011 event response was 
developed, and the systems and 
operations changes that would have 
been enacted in the event the ISS 
was decrewed. 

History 

Decrewing the ISS was not a new 
concept. The potential had existed 
ever since the first crew docked to 
the space station. In the early days, 
if a crew member became so ill that 
he or she had to return to the ground 
for immediate medical treatment, 
then the entire crew might have been 
forced to leave the ISS. With the 
advent of six-crew operations, it is 
more likely that at least one crew of 
three can remain on board. However, 
the ISS could become uninhabitable 
due to an off-nominal situation such 
as fire, depressurization, or major 
systems failure. These unlikely 
scenarios would not allow much 
time for preparation. With crew 
member safety being of the highest 
importance, the crew return vehicles 
will act as lifeboats to bring them 
home. Following an emergency, 
the ISS would be maintained and 
hopefully fully recovered in a best- 
effort capability using the technical 


expertise that NASA and its partners 
have developed over years of 
spaceflight experience. 

Planned decrewing of the ISS had 
also been discussed and documented 
multiple times. Early in the program, 
the planning of crew rotations 
sometimes ran into issues with the 
logistics of launch vehicle processing, 
meaning that the potential need 
for one crew to return before a 
replacement arrived existed, but 
it never actually occurred. At that 
time, the small-but-growing space 
station had been operated uncrewed 
for its first 2 years. Decrewing the 
ISS dealt a major impact to assembly 
operations and scientific research 
since crew members were required 
to perform many of these operations. 
However, decrewing was not thought 
to be a major concern for the overall 
survival of the station itself due 
to the design goal of being remote 
controlled. Over the years, barring 
any issues with vehicle upgrades or 
accidents, this planning became a 
well-oiled machine and is no longer 
much of a concern. Decrewing the 
ISS was also a topic following the 
Space Shuttle Columbia accident. 

The shuttles provided the capability 
to launch and return crew members, 
and deliver large quantities of 
consumables to the ISS. The Space 
Shuttle Program performed a lengthy 
investigation and recovery effort; 
thus, the ISS partnership was able 
to keep the ISS staffed by reducing 
crew size and relying on Russian 
capabilities to launch astronauts 
and supplies. At the time of the 
Progress 44P accident in 2011, which 
followed the retirement of the Space 
Shuttle fleet, no alternative to the 
Russian Soyuz crewed spacecraft to 
launch or return astronauts existed. 


The outcome of many of these 
discussions were documented in 
operational products, including 
procedures and Flight Rules. 

These products would be used 
and built upon to develop an 
operational philosophy for a 
decrewed space station. 

Framing the Discussion 

In many ways, it was up to the 
operations teams to determine how to 
continue operating without a crew on 
board. But first, the operations team 
and the ISS Program developed a set 
of priorities to drive the discussion 
and decisions that would result in the 
decrewed space station configuration. 

The high-level priorities, in order, 
were: 

1. Keep the ISS safely operating until 
a crew could return, and beyond. 

2. Prevent the loss of critical 
hardware and maximize critical 
system redundancy. This 
included performing preventative 
maintenance on systems whose 
expected lifetime would expire 
before a crew would return, and 
potentially using temporary power 
or data extension cables to increase 
flexibility following failures. 

3. Prevent loss of scientific data, 
and consider delaying the start 
of new scientific research that 
would be lost if the crew was not 
available to finish it. 

4. Optimize the ISS configuration 
to allow for an efficient return of 
a new crew. 

5. Continue scientific research 
that could be controlled from 
the ground. 
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Figure 1. Initial schedule for the 20111SS decrewing assessment. In the schedule, IMMT refers to the ISS Mission Management Team (see Introduction), 
27S and 28S refer to the 28th and 29th crewed expeditions, respectively, and TBR indicates the date is To Be Reviewed. 


Once these priorities were agreed 
to and established, the combined 
operations, engineering, and program 
teams set out to determine the best 
ISS configuration for decrewed 
operations. A lead flight director was 
assigned to integrate the operational 
aspects, develop a review schedule, 
and outline expectations for the team. 

At a high level, the team focused 
on the time available and actions 
required prior to decrewing, 
establishing the ISS and ground 
systems configuration, the operations 
plan (including emergency response) 
during decrewed operations, and 
developing a plan to recrew the ISS 


once the launch vehicle safety was 
reassured. A notional schedule (see 
Figure 1) was pulled together. This 
schedule outlined the 12 weeks that 
were available for the assessment. 

If, in the future, the potential to 
decrew the ISS arises again, a similar 
schedule would be used. 

This timeframe allowed approximately 
1 month to develop the recommended 
configuration. Once complete, the 
recommendation would be taken 
to the ISS Program for review and, 
hopefully, approval. One month 
prior to decrewing the space station, 
the ISS Mission Management Team 
(see also Introduction) would give 


final approval to implement the 
decrew configuration, which the team 
estimated would take 4 weeks of 
non-dedicated crew time—meaning 
the crew would continue scientific 
research, as well. 

Using these priorities, areas of focus, 
and schedule, the team divided into 
multiple groups to quickly assess 
the actions required. These groups 
jointly reviewed overall status 
biweekly, looking for concurrence 
on recommendations and requesting 
any assistance needed. The lead 
flight director then officially reported 
the status to the ISS Program 
management on a weekly basis. 
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System Changes 

Using the priorities established 
above, the decrewed ISS 
configuration was developed to 
ensure the station would continue 
to fly safely and perform scientific 
research. Although there would not 
be a crew on board to respond to 
emergency situations or repair broken 
equipment, many of the decrewing 
actions dealt with minimizing 
the potential for these events or 
increasing the ground operators’ 
ability to handle these situations. 

The already-docked Progress vehicle, 
42P, would be configured so that 
it could be undocked remotely by 
the Russian flight control team, if 
needed, yet continue to provide the 
ability to perform debris avoidance 
maneuvers (see Chapter 8). Similar 
to the Soyuz vehicle, this Progress 
had limited lifetime and would need 
to be undocked before posing a 
risk to the ISS, or before it would 
be unable to complete its mission. 
Also, undocking the Progress once 
its resources were expended would 
provide an additional open docking 
port for either a new Progress full of 
supplies or a redundant docking port 
for a returning crew. The most critical 
step in this preparation would be to 
have the crew remove the clamps that 
helped hold the vehicles together. 
Prior to its undocking, the ISS would 
be reboosted to a higher altitude 
to make use of available Progress 
propellant and prolong the orbital 
lifetime of the ISS in the event of a 
major delay of fuel resupply. 

Although the ISS has been designed 
to minimize the risk of an on-board 
fire, there is still the low likelihood 
that one could occur (see also 


Chapter 19). Since the crew would 
not be available to fight a fire, the 
risk would be further minimized 
by powering down non-essential 
equipment (based on priorities). This 
non-essential equipment includes 
crew-tended payloads and crew- 
support equipment such as the toilet. 

The crew also responds to ISS 
rapid depressurization emergencies 
potentially caused by orbital debris 
impacts by closing hatches between 
modules, which will hopefully isolate 
the leak to a single module. Initially, 
the team believed the best decrew 
configuration would be to isolate 
each module. Therefore, if a module 
started to depressurize, only that 
module would be affected. However, 
analysis of the isolated configuration 
for longer durations showed that 
a potentially large variation in 
pressure and temperature would 
occur between the modules. To keep 
the atmosphere of the ISS within 
temperature and pressure limitations, 
it would be best to keep air moving 
between the modules. The decrew 
configuration would have the crew 
close hatches prior to leaving, but 
Intermodular Ventilation (IMV) (see 
Chapter 19) would be left enabled, 
meaning vent ports and fans between 
modules would be left open and 
blowing. In the event of a depress, 
automatic software would deactivate 
the fans and close the vent ports, 
thereby isolating all of the modules. 
Leaving IMV enabled would 
assist with maintaining a uniform 
atmosphere between modules and 
could assist in some emergency 
events (see below). 

Humidity levels in the ISS 
atmosphere were another concern. 
Normally, water is added to the ISS 


atmosphere as the crew exhales and 
perspires. Humidity is removed 
from the atmosphere by the ISS 
Thermal Control System (TCS) to 
keep the crew comfortable, prevent 
condensation from damaging the 
equipment, and add to recycled 
water stores. This water is sent to 
the Regenerative Environmental 
Control and Life Support System 
(ECLSS) (see Chapter 19) for 
recycling. However, little to no water 
would be added to the atmosphere 
without a crew on board, and there 
was no safe controllable way for 
ground controllers to release water to 
increase humidity. Low humidity is a 
concern to the ISS critical electronics 
as it can lead to the buildup of static 
electrical charges. These static 
charges could potentially cause 
electrical arcs that would damage 
critical systems. These arcs would 
be similar to the shocks that can 
be felt when touching a metal door 
handle on a cold, dry winter day on 
Earth. To prevent drying out the ISS 
atmosphere too much prior to the 
crew leaving, the internal cooling 
loop temperatures would be raised 
to stop condensing water out of the 
atmosphere. The Environmental 
and Thermal Operating Systems 
(ETHOS) officer would need to 
actively monitor the fine balance 
of maintaining enough humidity in 
the atmosphere while preventing 
condensation on cooler surfaces. It 
is important to note that the ISS did 
not have a humidity sensor; thus, all 
of the information ETHOS would use 
for this monitoring would be based 
on temperature data and analysis. 

If the analysis was wrong and the 
atmosphere dried out, the ground 
team would not be able to recover the 
correct humidity levels. 
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Maintaining the viability of the 
Regenerative ECLSS (see Chapter 
19) was a major concern for the 
team. Although the Regenerative 
ECLSS is an engineering marvel 
that consistently recycles a large 
majority of the water on the ISS and 
provides clean drinking water and 
breathing oxygen, it is still a new 
technology that can be temperamental 
and require manual input to keep 
it running. Additionally, part of the 


closed-loop ECLSS is the crew. 

They inhale oxygen and drink water 
that is provided by the system. In 
turn, they exhale carbon dioxide 
and produce water in the form of 
perspiration and urine, which is 
taken into the system for cleaning. 
Without a crew on board, this closed 
loop is broken. One option for the 
decrewed configuration would be to 
deactivate the Regenerative ECLSS 
and let it sit idle after draining out 


the fluids or leaving the fluids (e.g., 
water or urine) stagnant. Removing 
all fluid from the system would be 
time consuming and difficult, and 
success could not be guaranteed. 
Additionally, the engineering team 
was concerned that parts would 
become damaged and need to be 
replaced if the Regenerative ECLSS 
was dried out, potentially leading to a 
long period of fine tuning the system 
to get it running again. If fluid was 


Preparing to Abandon Ship 

Colonel Mike Fossum, Commander, Expedition 29 

The crew of Expedition 28 was following the launch 
of the 44th Progress resupply vehicle (44P) with great 
interest because we knew the ship would bring not 
only necessary supplies, but also fresh food and care 
packages from home. When we heard about the launch 
failure, the crew huddled together to discuss the events. 
We were initially disappointed in the lost supplies; 
however, within a few minutes, we realized the booster 
used to get the Progress cargo ship into orbit was 
very similar to the one used to launch humans on the 
Soyuz spacecraft. The investigation of a rocket failure 
that scattered debris across many hundreds of miles 
was going to take time. Perhaps a lot of time. We knew 
immediately this might mean our stay on the ISS could 
be extended for as long as the on-orbit lifetime of our 
Soyuz spacecraft would allow. And it could mean we 
would be forced to leave before the next crew arrived. 
The ISS—an amazing orbiting laboratory representing 
the hopes and dreams of 15 partner nations—could 
be without a crew for the first time since Expedition 1 
began in 2000. The enormity of the situation quickly 
became clear. We had a new mission: Steel ourselves 
for a longer-than-intended stay, prepare the space 
station for operations without a crew on board, and do 
whatever we could to help prepare the next crew to take 
control of the ship with little to no handover time. 



Figure 2. Astronaut Mike Fossum installs an electrical bypass jumper to 
provide a redundandt power feed for the MBSU-1 in case the ISS had to 
be left uncrewed. 
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left stagnant, microbial growth and 
chemical changes to the fluid could 
occur. Think about the drains and 
water lines of a house that has been 
sitting vacant for an unknown amount 
of time. However, the Regenerative 
ECLSS was designed with multiple 
recirculation loops internal to 
processing equipment. These loops 
were included to allow for start-up 
transients or failures where the output 
of the system did not meet quality 


standards. In these cases, the output 
would be rerouted back to the input 
and sent through the system again, 
in an attempt to continue to further 
clean the water (see Chapter 19). 

The ETHOS controllers would 
periodically use these recirculation 
loops to move water through the 
Regenerative ECLSS for the duration 
of a decrewed configuration. This 
would keep the system running and 
prevent stagnant fluid concerns. 


Prior to decrewing, the crew would 
install multiple electrical power and 
thermal cooling jumpers to maximize 
critical system redundancy. At the 
time of the Progress 44P accident, 
the firmware controller for Main 
Bus Switching Unit (MBSU) (see 
Chapter 9) 1 was degraded. A jumper 
would provide power from a pair of 
parallel internal Direct-Current-to- 
Direct-Current Converter Units, since 
this increased the risk of MBSU 1 


Emotions on board ran the gamut. Members of the 
Expedition 27-28 crew were supposed to head home in a 
couple of weeks, but immediately started hearing rumors 
of a 2-month extension. Some were happy about having a 
longer stay, but some had already started thinking about 
returning to the delights of hot showers, real food, and 
loving families. I told my family that they would hear a lot 
of rumors, but don’t expect me home for Thanksgiving, 
Christmas, or New Years. Although nobody could know for 
sure, I figured it was better to just set the expectation early 
for both my family and myself. 

Meanwhile, the ground team, led by Flight Director Scott 
Stover, started working the plans for us to prepare the ISS 
in case we needed to leave it without a crew on board. 

The ISS is an amazing ship, but it was intended to be 
operated with a crew to help keep it running and recover 
critical systems in the event of failures. Our workdays 
accomplishing the myriad of science objectives became 
interspersed with just-in-case activities, such as running 
electrical jumper cables as thick as your forearm to provide 
a secondary source of power in case a critical electrical 
component failed (Figure 2). We went about these tasks 
with the grim realization that we could not protect for every 
possible thing that could go wrong. Without a crew on 
board, we were at risk of losing the ISS. 

While the specialists were working in Houston, Moscow, 
and around the planet to figure out how to protect the 
vehicle, we started thinking about how to help prepare 
the next crew members to be successful when they 


finally arrived. Our preflight training is very good, but 
many details associated with living and working on the 
Space Station are impossible to simulate and train on the 
ground. Under normal crew rotation schedules, we hand 
over those “tricks of the trade” during the 2 to 4 months, 
which we overlap on the ISS. By the time the senior crew 
departs, the junior crew is ready to take the lead, then 
train the incoming new crew. Knowing we would not 
have the benefit of significant (if any) handover training 
time, we started recording videos to show the new guys 
how to get the job done. This included a wide variety of 
activities such as compressing/sealing nasty wet trash 
bags, cleaning hard-to-access filters, and configuring the 
confusing pulmonary function test equipment. By the end, 
we sent down more than 22 hours of instructional videos. 

In the end, everything worked out very well. The Expedition 
27-28 crew returned home with only a 1-week delay. 

As the Commander of Expedition 29, I knew we were 
shorthanded for a couple of months; however, were ready 
when the crew of Expedition 29-30 (Dan Burbank, Anton 
Shkaplerov, and Anatoly Ivanishin) arrived on Soyuz 28. 

We didn’t sleep much during our 6 days of sharing the ISS, 
but thanks to the excellent preparation from the ground 
team and the crew’s dedication to extra training and video 
reviews, they were ready to take charge as we closed the 
hatch and headed home. Our homecoming was delayed 
only a week, and I arrived home to my family just in time 
for Thanksgiving. And a joyous homecoming it was! 
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failure and loss of power to half of 
the critical computers and cooling 
equipment on the ISS. A jumper 
could provide power from either 
MBSU 1 or MBSU 4 to these critical 
components. Additionally, critical 
power and computer equipment in 
both the Laboratory Module and 
Node 3 is nominally cooled by the 
Moderate Temperature Loop (MTL) 
of that module (see Chapter 11). In 
the event of an MTL leak during 
crewed operations, the crew would 
jumper critical equipment so that 
that it could be cooled by the 
Low Temperature Loop (LTL). 

For decrewing, half of the critical 
equipment would be preemptively 
jumpered to the LTL, meaning that 
a leak on either the MTL or the LTL 
would impact only half of the critical 
equipment. It is also important to note 
that in this jumpered configuration, 
the ground-controlled capability to 
integrate the MTL and LTL into a 
joined single loop is still possible; 
therefore, failure of a single ITCS 
pump would not cause the loss of 
cooling to critical equipment. 

The team looked into multiple ways 
to maximize ground insight and 
command capabilities to the ISS. 

At the time of the Progress 44P 
accident, all commanding to the ISS 
was through the S-band systems 
or Russian Ground Sites (see 
Chapter 13). To provide additional 
redundancy, the team developed a 
way to connect the crew’s Portable 
Computer System (PCS) (see 
Chapter 5) commanding laptops to 
the ISS Joint Station Local Area 
Network (JSL). Once connected 
to the JSL, a flight controller 
would be able to remotely log into 


the PCS using the ISS Ku-band 
system and then send commands 
from the PCS. The ISS Ku-band 
system was later updated to 
provide standard commanding 
without the need to log into a PCS. 
As an interesting sidenote, when 
originally brainstorming ways 
to command through Ku-band, 
the team recommended using the 
humanoid robotic payload Robonaut 
to physically interface with a PCS on 
board. This would have required a 
lot of development in a short amount 
of time since Robonaut operations 
were in their infancy at the time. 

As it turned out, the remote log-in 
capability was easier to implement. 

Additionally, the JSL is the gateway 
to the Ku-band system; therefore, 
ground control relies on an on¬ 
board laptop server. Nominally 
due to internet protocol and device 
identity limitations, only one laptop 
is configured as a server. If that 
server fails, the crew must deploy 
a new laptop. The JSL engineering 
and ops teams developed a way 
for a second laptop server to be 
deployed and powered in a standby, 
non-interference way. In this 
configuration, if the primary JSL 
server laptop failed, the PLug-in- 
plan UTilization Officer can easily 
configure the standby server to the 
primary role, thus restoring the JSL. 

Another hurdle in being able to 
operate the laptops from the ground 
is related to their power source. 
On-board laptops receive power 
from Utility Outlet Panels (UOPs) 
(see Chapter 5). If a UOP loses 
upstream power but is later 
recovered, it will not output power 
to downstream equipment without 


the crew physically cycling a switch 
on the UOP, much in the way a 
Ground Fault Circuit Interrupter 
works on many household electrical 
outlets. In a decrewed configuration, 
it was important that the PCS and 
JSL laptops that were acting as 
backup command capability could 
be repowered after a potential loss 
of upstream power. To offer this 
functionality, a UOP Bypass Jumper 
was installed to provide power 
directly from a Remote Power 
Control Module (see Chapter 9) to 
the laptops. This would allow the 
Station Power, Articulation, Thermal, 
and Analysis officer to remotely 
control power going to the laptops. 
Interestingly enough, the UOP 
Bypass Jumper was developed early 
in the life of the ISS when it was 
determined that the original electrical 
grounding sating function of the UOP 
did not work with the Robotics Work 
Station (see Chapter 15). Although 
the grounding issue was corrected, 
the UOP Bypass Jumper was retained 
on board in case of unexpected 
needs, such as decrewing the ISS. 

The crew is normally the on-scene 
eyes and ears of the flight control 
team. Video cameras or laptops 
with cameras were set up to supply 
overviews of each module, which 
would provide visual and auditory 
insight to the ISS during decrewed 
operations. The Communications 
Radio frequency Onboard Networks 
Utilization Specialist would then 
be able to cycle through available 
camera views to assist the flight 
control team in identifying off- 
nominal situations. This would be 
greatly beneficial in the event of a fire 
or rapid depress. 
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Emergency Response 

As discussed above, the crew 
takes a leading role in responding 
to emergency events on board the 
ISS. The team thoroughly reviewed 
emergency responses to develop a 
strategy for the flight control team to 
respond to each kind of emergency 
without a crew available. 

Rapid Depress 

As stated above, prior to leaving, the 
crew would close hatches between 
modules while the IMV was left 
enabled. If on-board sensors detected 
a depressurization, automatic 
software would close the IMV valves, 
thus isolating the modules. If a 
depressurization is too slow to trigger 
automatic software, the flight control 
team would manually command the 
Rapid Depress emergency response— 
an action usually taken by the crew. 
This would limit the depressurization 
to the leaking module or modules. 
Without a crew on board, the leaking 
module could not be repaired. At that 
point, the flight control team would 
unpower equipment in the affected 
module. If the affected module 
contained critical equipment, the 
flight control team would attempt 
to keep the critical equipment 
operational on a best-effort basis. 

Toxic Atmosphere 

As discussed in Chapters 11 and 19, 
one of the most dangerous events that 
can potentially occur on the ISS is 
the rupture of a TCS heat exchanger 
between the external and internal 
TCS loops. If this were to happen, the 
ammonia in the external loop would 
flood the internal loop and quickly 


fill the ISS atmosphere to lethal 
levels. Additionally, the pressure from 
ammonia entering the atmosphere 
could overcome ISS design limitation. 
However, a system of valves provides 
Positive Pressure Relief (PPR) by 
venting excess pressure overboard. 
This PPR is available only in certain 
modules. Many redundant levels of 
hardware design and hardware and 
software active controls prevent 
the heat exchangers from freezing, 
which could cause them to rupture. 
However, since the potential is so 
dangerous, the crew and ground 
teams train extensively to respond to 
a heat exchanger rupture. When crew 
members are on board, their response 
is to evacuate the United States 
On-orbit Segment (USOS), which is 
the only segment directly impacted 
by the ammonia. They do not have 
time to close hatches between USOS 
modules. However, the automatic 
toxic atmosphere software response 
does close IMV valves between 
modules. With the hatches left 
open, all USOS modules have PPR 
available. In a decrew configuration, 
the USOS hatches would be closed 
and automatic software that closes 
IMV valves would leave some 
USOS modules isolated with no 
access to PPR. If one of those 
modules contained the ruptured 
heat exchanger, that module would 
be exposed to pressures that could 
catastrophically damage the ISS. The 
team decided the best course of action 
was to inhibit the toxic atmosphere 
emergency software automatic 
response, which would leave the IMV 
valves open even if an ammonia leak 
was detected. This would provide 
PPR to the entire USOS, and would 
be similar to the crew response of not 


closing hatches. If the flight control 
team observed other potentially toxic 
substances via downlink cabin video 
or telemetry, the affected modules 
would be isolated by closing IMV to 
those modules. 

Fire 

Automated software response to 
a fire is to shut down both intra- 
modular ventilation and IMV fans 
(see Chapter 19). This is based on 
the fact that there is no convection in 
microgravity. Without convection or 
forced ventilation, fires will consume 
the locally available oxygen and then 
extinguish due to a lack of additional 
oxygen (see “Convection—Gravity’s 
Cooling Mechanism” in Chapter 11). 
Following ventilation shutdown, 
a crew would use air sampling 
equipment to pinpoint the location 
of a fire. Once the location was 
identified, equipment in that location 
would be unpowered to remove 
possible ignition sources. The crew 
would then investigate this equipment 
further to determine the cause of a 
fire, and set up equipment to remove 
smoke from the atmosphere. Flight 
controllers would not be able to 
pinpoint fire sources or perform 
detailed equipment inspections 
without a crew on board. In this 
scenario, the team determined the 
best fire response would be to allow 
the automated software to terminate 
ventilation. The ground team would 
then review available telemetry, 
including cabin video, to determine 
whether any equipment show off- 
nominal signatures. If telemetry 
pointed to a potential fire source, 
that equipment would be unpowered. 
Whether or not a potential source 
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was identified and unpowered, the 
flight controlled team would wait 
approximately 30 minutes to an hour 
for a fire to extinguish, and then 
reactivate ventilation to maintain the 
ISS atmospheric conditions and dilute 
any smoke in the cabin. If the fire 
reignited, ventilation would again be 
shut down. Additional scrutiny and 
powerdowns would follow prior to 
reactivating ventilation. 

Recrewing 

Per the ISS Program priorities, the 
team also took time to determine what 
actions, both on the ground and on 
board ISS, would best prepare for the 
arrival of a new crew to a decrewed 
station. This included identifying 
any consumables or equipment that 
would need to be launched with 
the new crew members, or prior to 
their arrival. Additionally, the team 
identified a list of items that the crew 
would need for quick access upon 
entering the station. This equipment 
included tools, air sampling devices, 
and personal protection equipment 
(i.e., gloves, goggles, masks) in case 
of an emergency on board while the 
space station was uninhabited. The 
current crew would gather these 
items and stage them in the Russian 
Segment where the new crew would 
be docking. A recrewing procedure 
and timeline was developed to 
return the ISS to a nominal 
configuration in the same way 
the team developed a procedure 
and timeline for implementing the 
decrewed configuration. 


Training 

Two important aspects of training 
were associated with developing 
the decrewed configuration. The 
first concern was crew training. In 
addition to preflight ground training, 
new crews received “handover” 
training from the current space 
station crews. This training revealed 
the most up-to-date configuration 
of the ISS, and provided hands- 
on tips and tricks to performing 
common procedures. If decrewing 
happened, the new crew would not 
have the benefit of this handover 
training. With that in mind, on-board 
crew members began making video 
recordings of common procedures, 
including voice-overs of the topics 
usually included during handover. 
They also recorded video tours of 
the ISS helping the ground teams 
understand the exact physical 
configuration of station systems and 
stowage. These videos were added to 
the training of the next crew and they 
continue to be used for future crew 
training. Additionally, the next-to- 
launch crew members aided in the 
development of the decrewing and 
recrew procedures. This added to 
their familiarity with the procedures 
and would greatly benefit the team in 
the event the ISS was decrewed. 

Second, the flight control team 
executed a decrewed configuration 
simulation. To do this, the ISS 
training team configured the ISS 
simulator to the expected decrew 
configuration. A team of experienced 
operators were then put through an 
exercise to respond to simulated 


equipment failures and emergency 
situations. This was used to test 
the decrew configuration and 
operational response. Although the 
team learned that some procedures 
would need to be modified, the 
simulation showed that the flight 
control team could maintain the ISS 
in a decrewed configuration. 

Conclusion 

When Progress 44P was lost due to a 
problem in the engine of the Soyuz U 
rocket’s third stage, the ISS Program 
was faced with the possibility of 
needing to leave the ISS uncrewed 
for an unknown amount of time. 

As seen in the past, the program, 
engineering, and operations team 
quickly stepped up to the challenge. 

First, priorities were defined. 

These included maintaining ISS 
safety and operability, increasing 
ISS system robustness, and assuring 
the capability of flight control 
teams to respond to off-nominal 
situations, thus enabling a returning 
crew to quickly recover nominal 
operations and continue scientific 
research. Using these priorities and 
building on previous discussions 
and documentation, the ground 
teams developed procedures, plans, 
and training to place the ISS in 
the best configuration to support 
uncrewed operations and return to a 
crewed configuration. 

The Russian Space Agency was 
able to determine the cause of the 
Progress 44P accident and return to 
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flying both Progress and the Soyuz 
vehicle before the need to decrew 
the ISS. However, having met the 
initial review and product plan, the 
team was prepared to implement the 
decrewed configuration and support 
the ISS, as necessary. If the potential 
to decrew the ISS arises again, a 
similar review will build off the 
plans, products, and lessons learned 
from this event. 
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Chapter 13 Systems: 

Communications 
and Tracking— 
The Vital Link 
to the International 
Space Station 




NASA astronaut Jim Voss and Russian cosmonaut Yury Usachov are having some fun with Mission Control as they demonstrate their alternative means for 
communicating with each other on the International Space Station during the second crewed increment. 


Some of the most iconic 
statements in human history 
such as “Houston, Tranquility 
base here . The Eagle has landed!” 
would not have been possible 
without a good communication 
system—an essential part of any 
crewed or uncrewed spacecraft . 

It is critical that the communication 
system works. It is the link between 
the spacecraft and its crew and the 
flight controllers on the ground. 
Without a good communication 
system, the crew will not have 
adequate insight into the condition 
of the International Space Station 
(ISS) and the ground may not 
be able to help during nominal 
events or, more importantly, 
during emergencies. Spacecraft 
communication systems move 
information from one place to 
another. Information on the ISS needs 
to move between modules of the 
spacecraft, between the spacecraft 
and visiting vehicles flying in 
proximity, and between the spacecraft 
and the control centers on the ground. 


The types of ISS information that 

need to be moved include: 

■ Commands and computer 
configuration data 

■ Health and status data on the 
various systems on the ISS 

■ Health, status, and ranging 
information of visiting vehicles 

■ Science experiment data 

■ Two-way voice and video 

■ Alarm tones 


The communication equipment is 
known as the Communication and 
Tracking (C&T) system because 
it can be used to follow, or track, 
the spacecraft. This chapter will 
discuss the essential aspects 
of the C&T system. The main 
communication systems on board 
the ISS are organized into two prime 
areas: Radio Frequency (RF) and 
Baseband. A total of eight types of 
communication systems are located 
within these two main areas. Table 1 
summarizes the key systems and the 
number of each type. 


Table 1 . A summary of the different communication systems on the ISS. The RF systems are broken 
down by the portion of the electromagnetic spectrum that each uses (defined below). The numbers in 
parenthesis indicate how many of each system exists. 


Types of Communication Systems on the International Space Station 

■ S-band 

■ Ku-band 

■ Ka-band 
. L-band (for GPS) 

■ Ultra-high frequency (UHF) 

■ Very-high frequency (VHF) 

■ Audio 

■ Video 


* Includes the original ISS S-band system known as the Early Communication System, a temporary 
communication system used during the first 3 years of space station operations until the main 
systems were activated. 


RF 


Baseband 
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Radio Frequency 
Communication Systems 

Conventional communication 
systems dating back to the first 
spacecraft—Sputnik, launched 
by the Russians in 1957—use RF 
links. Radio waves of varying 
frequencies are the same as those 
used by car radios, televisions, and 
cell phones. They are generally ideal 
for communicating with spacecraft 
because they tend to use minimal 
power, and the longer wavelengths 
can easily penetrate the Earth’s 
atmosphere. But a trade-off exists 
between frequency and the amount 
of information the signal can contain. 
Higher-frequency radio waves can 
carry more information but are more 
susceptible to signal degradation 
as the waves travel through the 
atmosphere. For example, satellite 
TV systems operate in the Ku-band; 


the radio waves are susceptible 
to heavy rain showers when the 
signal might be lost temporarily. 

The ISS uses different systems in 
different bands, depending on the 
specific need. Figure 1 depicts the 
electromagnets spectrum with the 
key bands used by the ISS. 

The main communication path relies 
on the NASA Tracking and Data 
Relay Satellite (TDRS) system, 
whereas the VHF link provides a 
direct radio transmission between 
a ground station and the ISS. The 
TDRS system consists of a number 
of satellites in geosynchronous orbit 
about the Earth that provide a relay 
link for the S- and Ku-bands between 
ground stations and the space station. 
With the satellites being distributed 
around the planet, the ISS can be 
in continuous communication with 
Mission Control. 


S-band 

The term S-band refers a specific 
range of radio frequencies at which 
the communication systems operate. 
The S-band range is a subset of 
the super-high-frequency range; 
specifically, 2 to 4 gigahertz. This 
type of RF communication system 
is the most common on the ISS. 

The S-band communication 
system is comprised of three boxes 
referred to as Orbital Replacement 
Units: the Baseband Signal 
Processor, the Transponder, and the 
Radio Frequency Group (RFG). See 
Figure 2. The Orbital Replacement 
Units are mounted outside the ISS. 
One set is mounted on the P1 truss 
segment and the other set is mounted 
on the S1 truss segment. Only one set 
is used at a given time, and the two 
sets are alternated. 
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Figure 1 . The RF spectrum used by ISS communication systems. By convention, the electromagnetic spectrum has been divided into specific bands. 
Several bands were delineated by their frequency range — high, very high, ultra, etc.—but several bands were also classified into smaller subdivisions and 
indicated by letters of the alphabet. 
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Keeping the Lines of Communication Open 

The official name of the ISS S-band communication system is the Assembly 
Contingency Subsystem. Originally, the S-band system was intended to 
be used only during the ISS assembly sequence and, after that, only in 
contingency cases. The Ku-band system was intended to be the primary 
communication link for the ISS. To defer costs, the build-up of the Ku-band 
system was extended over more years than originally planned. The S-band 
system continues to operate as the prime communication system for the ISS. 
The Ku-band system is used primarily to support ISS utilization. 


The S-band system is used to send 
commands from control centers 
around the world to the ISS. Because 
of this, the system is designated with 
the highest level of criticality. The 
second S-band system is activated 
and configured as a “hot” backup 
for critical operations where an 
unexpected failure of the S-band 
system would threaten the safety of 
the ISS crew members, spacecraft, 
or mission objectives. Upon a 
failure of the primary system, the 
communication link is recovered 
in a minimal amount of time 
(~40 seconds). The S-band system 
is also the primary means of sending 
telemetry data from the ISS to the 
ground. The telemetry data are 
sent to the ground in real time to 
support operations. These data can 
be stored on virtual recorders on 
board the ISS and sent down later. 

Another critical function of the 
S-band system is to provide two-way 
voice communication with the ISS 
crew members and the control centers 
around the world. The S-band system 
has two separate voice channels 
referred to in operations as Space-to- 
Ground (S/G) 1 and S/G 2. Although 
interchangeable, the channels are 
allocated specific uses that are defined 
in operations policies. 


Software files that can be used by 
the on-board computers and records 
containing data about the ISS can 
be exchanged between the vehicle 
and the ground using the S-band 
system. Almost 300,000 individual 
pieces of data (e.g., temperature, 
energy level of a battery) have been 
designated for possible radioing to 
the ground. However, this represents 
only a subset of the data available on 
the ISS. About 10% of those values 
can be sent down via S-band every 
10 seconds. Sometimes, the flight 
controllers need to look at these 
additional data. Therefore, bulk 
quantities of unprocessed data can 
be retrieved directly from memory 
in the on-board computers. This data 
retrieval is useful in troubleshooting 
a malfunctioning piece of equipment 
or misbehaving computer software 
without exhausting the available 
bandwidth all the time. 

The S-band system is capable of 
being operated in two modes: a 
high-data-rate (HDR) mode and 
a low-data-rate (LDR) mode. The 
HDR mode consists of a forward 
link (i.e., transmission to the ISS) of 
72 kilobits per second (kbps) and a 
return link (i.e., transmission from 
the ISS) of 192 kbps, and this mode 
simultaneously supports a pair of 


two-way voice channels (S/G 1 and 
S/G 2). The term “high” is relative 
as, these days, most people carry 
RF communication devices that 
communicate at speeds significantly 
faster. For example, depending on the 
city, carrier, and plan, one can expect 
smartphone download speeds of at 
least approximately 3 to 10 megabits 
per second (mbps)—about 15 to 
52 times faster than the ISS S-band 
system. The LDR mode consists 
of a forward link of 18 kbps and a 
return link of 24 kbps, and supports 
one two-way voice channel (S/G 1). 
This is slower than an old dial-up 
modem, which had speeds of 56 kbps. 
Originally, link speeds were 6 kbps 
and 18 kbps, respectively, with no 
voice channels. Later, the S-band 
system was upgraded, primarily to 
add one two-way voice channel to the 
LDR mode. 

HDR is the primary operation mode. 
This mode requires the use of the 
high-gain antenna (HGA) located in 
the RF group. The HGA is a steerable 
antenna and needs to be pointed 
precisely at the TDRS being used 
to relay the signal from the ISS to 
the ground. The data used to point 
the HGA originate in the Guidance, 
Navigation, and Control (GNC) 
Multiplexer/DeMultiplexer (MDM) 
and are sent to the Command and 
Control (C&C) MDM where they 
are converted to commands for the 
RFG (see Chapters 5 and 7). The 
commands are automatically sent to 
the RFG once per second to keep the 
HGA pointed at the correct satellite as 
the ISS orbits the Earth. 

If computers are not able to point the 
HGA due to a failure of its gimbal 
motors or a failure preventing the 
pointing data to be generated or sent 
to the RFG, then the flight control 
team will use the LDR mode. The 
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Figure 2. The S-band RFG on the SI truss segment, with the HGA and LG A highlighted. 


LDR mode uses a hemispherical 
antenna. This antenna is not steerable 
and therefore does not depend on the 
GNC or C&C MDMs. However, its 
field of view is limited; therefore, 
the amount of time this antenna is 
in a line of sight of a TDRS satellite 
is also limited. For this reason, and 
because of the slower data rates, the 
LDR mode is used for contingency 
purposes only. 

A total of four operating modes 
are possible with HDR and LDR 
modes on each of the two strings of 
S-band. The modes can be changed 
manually by the flight control team 
on the ground or by crew members 
on the ISS. Generally, only one mode 
is used: HDR on one of the strings 
of S-band. The other modes and 
string act as a backup configuration. 


Fault detection, isolation, and 
recovery software, which can detect 
whether a component fails and then 
reconfigure to a backup unit, can also 
change the mode. 

Ku-band 

The Ku-band system is officially 
known as the Space-To-Ground 
Subsystem and operates at a forward 
link frequency of 13.7 MHz and a 
return link frequency of 15.0 MHz. 
This system was designed for 
and intended to be the prime 
communication system for the ISS 
precursor: Space Station Freedom. 

The Ku-band system was redesigned 
when the plans for Space Station 
Freedom changed to the ISS (see 
Introduction). The redesign was 


needed to accommodate the higher 
radiation environment encountered at 
the orbit in which the ISS would fly 
(see Introduction). In the beginning 
of ISS operations, the forward link 
operated at 3 mbps and the return link 
operated at 50 mbps. Although these 
data transfer rates are significantly 
higher than the S-band capacity, 
there was a growing need to have 
more bandwidth, especially to 
accommodate some of the planned 
payloads on the ISS. Upgrades 
that were made to ground systems 
allowed the downlink rate to increase 
to 150 mbps and the uplink rate to 
6 mbps. In 2007, NASA completed a 
major upgrade of the Ku-band system 
that boosted the forward link rate 
to 25 mbps and the return link rate 
to 300 mbps. NASA engineers are 
exploring options to further increase 
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Figure 3. STS-132/ISS-ULF4 mission specialist Steve Bowen works to install the backup Space-to-Ground Antenna (the white radio dish near the top left of 
the figure) on the Z1 truss (located next to the original antenna, which is angled to the right). 


the Ku-band return link rate as science 
experiments on the ISS require faster 
and faster return link rates. 

The ISS has two Ku-band systems; 
only one system is used at a time. The 
Ku-band system in its current state 
consists of the Ku Communications 
Unit (located inside the ISS) and the 
Transmitter/Receiver/Controller and 
Space-to-Ground Antenna (both of 
which are mounted outside the ISS). 
See Figure 3. 

The Ku-band system is used to 
transmit all video—internal and 
external—from the ISS. Live and 
recorded video are transmitted 
in high definition and standard 
definition. High definition has 
become the preferred format as 
the available bandwidth from the 
ISS has increased. Two-way video 


Astronauts Make the Call... From Space! 

The ability to make a telephone call from the ISS is extremely helpful to the 
crew members, psychologically, by allowing them to feel more connected 
to home. Calls may be personal—to a spouse or dear friend—or to the 
flight director to talk privately about an issue. However, this process is not 
as straightforward as making terrestrial phone calls. In particular, the crew 
can conduct a call only when the Ku-band satellite link is present. The calls 
must be initiated by the crew for privacy and security reasons. Receiving a 
phone call from space is a fun and unique experience. However, cases have 
occurred where recipients were incredulous about incoming calls from the 
ISS and would hang up on the caller. Also, as with phone calls on Earth, 
the wrong number can be dialed, which has happened on occasion. This 
system is also useful for the ground team. On more than one occasion, the 
crew was required to fix a problem with the S-band radio link. Because of the 
ground team’s inability to call the crew over the S-band radio link to request 
a procedure, the crew’s timeline was re-uplinked via the Ku-band system 
with a big banner-type message that instructed the crew to initiate an internet 
protocol call to Mission Control. 
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conferencing is supported and used 
routinely. The Ku-band system was 
upgraded to support a pair of two- 
way voice communication channels. 
Operationally, these channels are 
called S/G 3 and S/G 4. They augment 
the S/G 1 and S/G 2 channels in 
the S-band system. The ISS crew 
members can use the Ku-band system 
for email, internet access, and phone 
calls (i.e., internet protocol calls) to 
any number on Earth. The biggest 
use of the Ku-band system are the 
payloads that conduct scientific 
experiments on board the ISS. All the 
scientific data are transmitted to the 
ground by the Ku-band system. 

The forward link of the Ku- 
band system is used to transmit 
operational planning data, control 
experiments, and to remote log-in 
to the ISS Local Area Network. The 


remote log-in process is needed to 
conduct operations (e.g., controlling 
Robonaut) and troubleshoot 
equipment, and to support email, 
two-way video conferencing, and 
telephone calls. 

The Ku-band system is the 
communication workhorse of the 
ISS. Every nation involved in the ISS 
depends on the system, mainly for 
their scientific research. 

The Ku-band system is highly 
directional. It must be pointed at the 
TDRS satellite within 0.5 degrees 
to transmit the high data rates. The 
GNC MDM and C&C MDM produce 
the pointing angles for the Space-to- 
Ground Antenna gimbals at a rate of 
once per second. The antenna then 
uses these angles to initiate a search 
of the forward link signal that is 


being relayed from the ground by 
the TDRS satellite. Once locked onto 
the signal, the antenna uses that signal 
to automatically track the TDRS 
satellite within the required accuracy. 

Ultra-High Frequency 

The ISS is equipped with a 
bidirectional UHF communication 
system, as seen in Figure 4. 

The UHF systems provides 
two-way voice communication 
with the spacewalking astronauts 
and the ISS. A two-way voice link 
between the spacewalking astronauts 
and the flight control team on the 
ground is established when the 
audio portion of the UHF system 
is connected to the S-band system. 
Data from the astronauts’ suit and 



Figure 4. Mission Specialist Dave Wolf during STS- 127/ISS-2 J/A on the PI truss directly behind the UHF antennae. 
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biomedical data from the astronauts 
are transmitted to the ISS on the UHF 
system and then sent to the ground 
via the S-band system. 

The UHF system is only meant to be 
used around the vicinity of the ISS. 
The system cannot communicate 
directly with UHF stations on the 
ground because of the way the data 
are incorporated into the radio signal. 

Wireless External 
Transceiver Assembly 

Another radio frequency 
communication system— the 
Wireless External Transceiver 
Assembly—is associated with US 
spacewalks (Figure 5). The more 
common name for this system is 
the helmet cam video. Through a 
combination of a UHF link and an 
S-band link, the cameras that are 
mounted to the spacewalkers’ helmets 
provide real-time video back to the 


ISS. This video can be transmitted 
to the ground via the Ku-band 
system. The UHF link is used to 
issue commands to the three cameras 
that are mounted on the helmet. The 
S-band link is used to transmit the 
live video from one camera at a time 
to antennae mounted on the ISS. 

Ship-to-Ship 
Communication Systems 

All spacecraft that approach the 
space station communicate directly 
with the ISS, once in range. 
Communications between spacecraft 
is often called “ship-to-ship.” The 
type of communication system, the 
capabilities, and the usable range 
vary from one spacecraft to another 
even though they are typically in 
the S-band portion of the spectrum. 
The Space Shuttle communicated 
with the space station via a UHF 
communication system that supported 



Figure 5. Mission Specialists Michael E. Lopez-Alegria (left—red stripes) and John B. Herrington 
(right—no stripes) perform Starboard Keel Pin operations on the PI truss during STS-113/ISS-11A. 
The Wireless External Transceiver Assembly antenna is in view in the upper left (red arrow), above the 
Crew and Equipment Translation Cart. 


limited commanding, limited 
telemetry exchange, and two-way 
voice between the commanders of 
the two vehicles. The uncrewed 
cargo vehicles that resupply the 
space station (see Chapter 14) also 
communicate directly with the ISS, 
when in range. Incoming vehicles 
receive navigation information 
from the ISS that may be used to 
perform a rendezvous using Global 
Positioning Satellite data for each 
vehicle. Uncrewed cargo vehicles 
also accept crew-issued commands 
over the ship-to-ship communication 
system (e.g., abort and retreat) 
and provide telemetry on their key 
systems back to the ISS for the crew 
to monitor. These RE ship-to-ship 
communication systems are typically 
active only during the approach of 
the visiting vehicle. After a successful 
capture or docking, the system is 
deactivated. The operation of the 
system is the joint responsibility 
of Mission Control and the control 
center associated with the visiting 
vehicle (see Introduction). 


Baseband Communication 
Systems 

Audio 

An audio system on board the ISS 
allows crew members to talk to each 
other across modules and talk to the 
control centers on the ground. A key 
component of the audio system is the 
Audio Terminal Units (ATUs), shown 
in Figure 6. The ATU is essentially 
a complicated intercom system. The 
microphone converts speech-to-digital 
signals that the audio hardware then 
routes to any other communication 
panel on the ISS. A speaker reverses 
the digital-to-speech conversion. 


228 


CHAPTER 13 SYSTEMS: COMMUNICATIONS AND TRACKING-THE VITAL LINK TO THE INTERNATIONAL SPACE STATION 






Fourteen ATUs are located throughout 
the United States On-orbit Segment 
(USOS) (Figure 7). The audio system 
also connects to the S-band and 
Ku-band systems to give the crew 
members access to the space-to- 
ground voice loops. Three alarm tones 
(emergency, warning, and caution) 
signal that something serious has 
occurred and the crew members are to 
respond (see Chapter 5). These alarm 
tones are also annunciated through the 
audio system. 

The audio system is a Time Division 
Multiple Access digital system. 

As many as five conference calls 
can be supported simultaneously 
with up to 12 ATUs connected to 
each conference. An ATU can be, 
and usually is, connected to more 
than one conference at a time. The 
astronaut is able to talk to anyone 
on the ISS or the ground that is 
tied into that conference by simply 
pushing a button on the ATU for 
the appropriate conference call. In 
a typical operational configuration, 
the first conference, known as Public 
Call 1, will include the Russian 
Segment and is used to talk to all 
crew members throughout the ISS 
during an emergency. The Russian 
Mission Control Center uses Public 
Call 1 for daily operations with 
the cosmonauts. The Americans, 
Europeans, and Japanese use two 
other conferences, known as Public 
Calls 2 and 3, for day-to-day systems 
operations and for payload (science) 
operations. The fourth conference, 
known as Public Call 4, usually 
includes only the USOS modules and 
is used by American, European, and 
Japanese control centers for private 
communications (e.g., when a crew 
member is conducting a planned, 
weekly conference with a flight 
surgeon or family member). 



Figure 6. Three ATUs (red arrow) are located at the top, above the spacesuit, in the airlock. During 
preparation for a spacewalk, the suited crew members can plug into these units to communicate with 
each other and the rest of the crew or to the ground without using the battery-powered UHF system in 
the suit. Or, a crew member who is assisting the spacewalkers can use the ATU as a normal intercom. 



Figure 7. Location of the ATUs throughout the USOS. In addition to providing communication between 
crew and ground, the ATUs provide caution and warning alarms. 
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Video 

The video system on board the ISS 
generates and distributes high- 
definition and standard-definition 
video. As with audio, video signals 
can be routed from a variety of 
sources and directed to an assortment 
of destinations—whether it be to a 
computer monitor for the crew or 
to the ground. Standard definition 
cameras that are mounted externally 
are known as the External Television 
Camera Group (Figure 8). This group 
consists of the camera that can be 
panned, tilted, and zoomed, a light 
that moves with the camera, and a 
controller. These cameras operate 
continuously on the ISS and provide 
video of spacewalking astronauts, 
views of visiting vehicles, or views 
of the outside of the space station 
for the ground controllers to monitor 
(see Chapter 17). 

The crew on board the ISS and by the 
flight control teams and engineering 
support teams around the world 
use the video system to monitor 
spacewalks, robotics operations, 
and arrival and departure of visiting 
vehicles, as well as for inspections 
of the ISS. Recall that there are very 
few windows to actually allow the 
crew to see outside. Live video of 
the astronauts can be useful for the 
ground team to monitor activities and 
assist the astronauts in their work. 
When the ISS bandwidth allows 
(i.e., not all in use by payloads or 
telemetry), one video feed from the 
ISS is streamed live on the internet. 
Occasionally the external cameras 
are used to track hurricanes and 
typhoons since the ISS provides a 
unique, real-time vantage of such 
situations. The video system is a key 
part in conducting media outreach- 
type events on board the ISS to 


help educate the public about life 
on the ISS. Often, the astronauts 
participating in the live event serve 
as their own camera crew. They will 
set up the camera in advance. Then, 
the flight control team will configure 
the video and Ku-band system to 
bring the view from the camera 
to the ground where the NASA 
Public Affairs Office distributes the 
video to the client. Figure 9 shows 
Expedition 31 flight engineer and 
European Space Agency astronaut 
Andre Kuipers setting up a camera in 
preparation for a Public Affairs Office 
event in the US Laboratory. Two 
other cameras are visible in addition 
to the one Kuipers is setting up. Over 
time, the camcorders on the ISS were 
replaced with more recent models. 

The video from these cameras 
and the video from the Wireless 
External Transceiver Assemblies go 


external to internal by way of one 
of three external video switching 
units. Once internal to the ISS, 
the video is further distributed by 
one of four video switching units. 
High-definition video recorders are 
typically distributed throughout the 
USOS modules inside the ISS. The 
video from these recorders is also 
distributed throughout the ISS and 
are connected to the Ku-band system, 
allowing video to be downlinked to 
the ground. The video units are also 
connected to the Robotic Workstation 
monitors in the Cupola and the US 
Laboratory, thereby allowing the 
crew to view the live video from the 
External Television Camera Groups 
or from the Mobile Service System 
(see Chapter 15). Usually, the flight 
controllers will configure the video 
system when it is needed, leaving the 
crew to only power up and position 
internal cameras. 



Figure 8. View of the SI truss segment External Television Camera Group. The white oval is the light 
attached to the camera (tan rectangular box directly to the left of the light). If there is nothing critical to 
watch at the ISS, the flight controllers will point the cameras at the Earth to allow the team to enjoy the 
view from above in the control center. 
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Figure 9. In 2012, Expedition 31 flight engineerand European Space Agency astronaut Andre Kuipers works with a video camera while preparing fora 
Public Affairs Office event in the Destiny US Laboratory 


Managing the video system is a 
complicated job performed by 
the Communication Rf On-board 
Network Utilization Specialist. 

The video management needs to be 
planned in advance and executed on 
time because of the dozens of video 
sources on board the ISS, Ku-band 
return link bandwidth limitations, 
time constraints, and input and output 
constraints on the video switches. In 
addition, a number of payloads use 
video, recorded and live, to observe 
experiments and document the results. 
The daily coordination spans multiple 
control centers around the world. 


Conclusion 

Since the beginning of the Space 
Age, video and audio communication 
systems have been referred to as 
the eyes and ears of a spacecraft. 

The communication system of a 
spacecraft has always been vital to 
a mission, whether for video of an 
astronaut saying, “Roger, zero-g and 
I feel fine,” from the moon, or video 
of plants or other experiments on 
the ISS, In addition to bringing the 
cosmos to Earth, the ground uses 
communication systems to support 
the astronauts by ensuring they 
complete their missions safely and 


effectively. The ISS has a number 
of different communication systems 
that are used for highly specific 
functions. Audio communication 
between crew members on the 
large space station, as well as the 
ground, allows for timely, efficient 
operations. Video can be used to 
provide information about life on 
board the space station or to record 
data. Due to the critical nature 
of communication, the systems 
are designed with a great deal of 
robustness and redundancy. To help 
ensure a smooth operation, the 
flight control team is just a quick 
call away. 
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Chapter 14 Day in the Life: 

Vital Visiting Vehicles— 
Keeping the 
Remote Outpost 
Crewed and Operating 




Expedition 45 astronauts and cosmonauts gather to watch the launch of the Orbital ATK Cygnus resupply spacecraft atop of the United Launch Alliance 
Atlas V rocket from Cape Canaveral, Florida on December 6, 2015. 


Purpose and Importance 
of Visiting Vehicles 

On Earth, a person's typical week 
might consist of a trip to the grocery 
store, several trips to the local home 
improvement store, taking out the 
trash and recyclables, and doing a 
few loads of laundry If something 
is broken in the home, a replacement 
part is ordered and the homeowner 
must wait for a delivery. Or, he or she 
might need to schedule a professional 
to make the repair. Homeowners 
probably do not think about the water 
supply. They definitely do not worry 
about the supply of oxygen needed 


to breathe or the removal of carbon 
dioxide that is expelled from the 
human body. 

The International Space Station 
(ISS) is a unique, world-class 
orbiting laboratory. It is also home 
to astronauts and cosmonauts. The 
logistics of keeping such a home 
running are complicated. In space, 
there are no grocery stores or home 
improvements stores. The “trash 
truck” only comes around every 
few months. Washers and dryers for 
clothing do not exist, and access to 
clean attire can take months. Much of 
the breathable air and drinkable water 
must be delivered. When supplies 


(e.g., bathroom tissue) are low, crew 
members cannot tap a few keys on the 
computer and wait for resupplies to 
arrive at the door. They call Mission 
Control and place their order, and 
then they wait. 

Moving astronauts and cosmonauts, 
science experiments, food, water, 
air, spare parts, and other supplies 
to and from the ISS is a highly 
choreographed international 
operation that must be executed 
with near perfection, every time (see 
Chapter 1). Such an effort requires 
more than one spacecraft. This 
was never more evident than in an 
8-month span between October 2014 
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and June 2015 when three different 
resupply missions were lost 
during or shortly after launch. 

Three different rockets from three 
different companies experienced 
three different failures. According 
to statistics, this scenario was 
supposed to be nearly impossible. 

Yet, it happened. Operations on 
board the ISS continued despite the 
lack of resupply. 

So, exactly what does it take to 
keep the ISS resupplied? It starts 
with a procession of vehicles from 
around the world that visit the ISS. 
This chapter will discuss this lineup, 
including the unique way the vehicles 
are attached to the space station 
and how heavily they rely on the 
robotic system. The critical role of 
the crew, how a vehicle controlled by 
another government or a private US 
company is safely integrated into the 
operations of the ISS, and how their 
flight control teams train and interact 
with the NASA flight control team in 
Houston, Texas, are also presented. 
Details for the Russian cargo vehicle, 
Progress, are not discussed here. 

Lineup of Visiting Vehicles 

Space Shuttle (retired)—The NASA 
Space Shuttle was launched from 
Kennedy Space Center in Cape 
Canaveral, Florida, and controlled 
from Mission Control Center- 
Houston (MCC-H). It carried crew 
of up to seven and cargo to and from 
the ISS. The shuttle could deliver 
approximately 19,000 kg (42,000 lbs) 
of cargo, usually in the form of 
modules or elements in the external 
cargo bay, but it could also transport 
dry and wet cargo. Dry cargo consists 
of hardware, food, and other non¬ 


wet consumables whereas wet cargo 
generally refers to water, nitrogen, 
oxygen, or air. The shuttle docked to 
the United States On-orbit Segment 
(USOS) of the ISS. As happens with 
all the visiting vehicles, dry cargo is 
always accessed from the pressurized 
part of the vehicle in a shirt-sleeve 
environment. Figure 1 shows the 
Space Shuttle docked to the ISS, as 
well as the next several vehicles, in 
what was termed the “family portrait.” 

Soyuz —The Russian Soyuz 
Spacecraft launches from the 
Baikonur Cosmodrome in Kazakhstan, 
and is controlled from the Mission 
Control Center-Moscow (MCC-M) in 
Korolev, Russia. It carries a crew of 
three and a limited amount of cargo 
to and from the ISS. The Soyuz docks 
to one of several ports on the Russian 
Segment (RS) of the ISS. 


Progress —The Russian Progress 
Spacecraft launches from the 
Baikonur Cosmodrome in 
Kazakhstan, and is controlled from 
the MCC-M in Korolev, Russia. It 
carries cargo to the ISS and removes 
trash from the ISS via destructive 
reentry. The Progress can transport 
approximately 2,600 kg (5,732 lbs) 
of dry and wet cargo to the ISS and 
docks to one of several ports on the 
ROS. Unique among the current 
visiting vehicles, the Progress also 
transports propellant for the re-boost 
and refueling of the station. 

Automated Transfer Vehicle (ATM) 

(retired)—During five missions 
between 2008 and 2014, the European 
Space Agency (ESA) launched the 
ATV from the Centre Spatial Guyana 
near Kourou, French Guiana, and 
controlled it from the ATV Control 



Figure 1. This image was taken in May 2011 by Expedition 27 crew member Paolo Nespoli from 
the Soyuz (25S) following its undocking to return the Expedition 27 crew to Earth. These are the first 
images of a Space Shuttle docked to the ISS, as taken from another crewed spacecraft. 
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Center in Toulouse, France. Each 
ATV carried cargo to the ISS and 
disposed of trash from the ISS via 
destructive reentry. The ATV was able 
to deliver 8,000 kg (17,637 lbs) of 
supplies, including dry and wet cargo 
with propellant for the re-boost and 
refueling of the station, and docked to 
the aft docking port of the RS. 

//-// Transfer Vehicle (HTV) 

Kounotori (White Stork)—Japan 
launches the HTV from the 
Tanegashima Space Center in 
Tanegashima, Japan, and controls 
it from the HTV Control Center in 
Tsukuba, Japan. The HTV carries 
cargo to the ISS and disposes of trash 
from the ISS via destructive reentry. 
The HTV is captured by the Space 
Station Remote Manipulator System 
(SSRMS) and is then berthed to the 
USOS, as shown in Figure 2. Each 
HTV can deliver approximately 
7,600 kilograms (16,800 lbs) of 
cargo, including external cargo 
transfer capability. 

Dragon —Developed by the 
commercial company Space 
Exploration Technologies 
Corporation (SpaceX), Dragon 
launches from Cape Canaveral, 
Florida, and is controlled from the 
SpaceX Mission Control Center 
in Hawthorne, California. Dragon 
carries cargo to the ISS and returns 
cargo and science via splashdown 
in the Pacific Ocean off the coast of 
California. As with HTV, Dragon is 
captured by the SSRMS and berthed 
to the USOS, as shown in Figure 3. 
Dragon can transport approximately 
5,400 kg (12,000 lbs) of cargo, 
including some items externally in its 
exposed “trunk.” 



Figure 2. The Japan Aerospace Exploration Agency Kounotori HTV-5 is seen berthed to the ISS 
(vertical, leftside of image). The external CALometric Electron Telescope experiment, which will search 
for signatures of dark matter, is seen being extracted from the unpressurized section by the station’s 
robotic arm, Canadarm2. An aurora over the Earth limb is visible in the background. Photo is from 
August 25, 2015. 



Figure 3. View of the berthed SpaceX Dragon Commercial Resupply Services-3 spacecraft on April 26, 
2014, Canadarm2 SSRMS, and portions of the forward ISS in front of an orbital dawn. 
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Figure 4. The Orbital ATK Cygnus spacecraft about to be captured by the Canadarm2 on March 26, 
2016, before being berthed to the nadir port of the Node 1 module of the ISS, as photographed by an 
Expedition 47 crew member. The Earth can be seen in the background. 


Cygnus —Also developed by a 
commercial company, Orbital ATK, 
the Cygnus can launch from the 
Mid-Atlantic Regional Spaceport 
on Wallops Island, Virginia, or from 
Cape Canaveral, Florida. The mission 
is controlled by a team at Mission 
Control Center-Dulles located in 
Dulles, Virginia. Cygnus carries 
cargo to the ISS and disposes of trash 
from the ISS via destructive reentry. 
As with the HTV, the Cygnus is also 
captured by the SSRMS and berthed 
to the USOS (Figure 4). Cygnus 
can deliver up to about 3,600 kg 
(7,940 lbs) of cargo to the ISS. 


Preparation for the 
Arrival of an H-ll Transfer 
Vehicle, Dragon, or 
Cygnus Visiting Vehicle 

Scheduling 

As described in Chapter 1, the 
flight control team works with ISS 
Program personnel, including the 
international partners, to meticulously 
plan the rotation of crew members, 
delivery of new science experiments, 
return of completed experiments, 
and resupplies for the ISS. Launch 
schedules around the world need 
to be negotiated. This, in itself, can 
be extremely complicated. Each 
company or government launches 
other payloads; therefore, delays 
on one vehicle, due to weather 


or technical issues, can impact 
other missions to the ISS. Careful 
coordination is also required to 
manage the available ports for 
berthing the vehicles. The only two 
berthing ports are located on the 
nadir, or bottom, side of the ISS. 
Cargo preparation and delivery 
schedules need to be established 
and often adjusted when equipment 
unexpectedly fails or priorities 
change. In some cases, the orbit 
of the ISS needs to be adjusted to 
accommodate the arrival of the 
visiting vehicle. Physics determines 
how quickly a spacecraft can get to 
the ISS, and must be factored into the 
power and fuel with which the vehicle 
has to perform the rendezvous. The 
number of constraints that need 
to be simultaneously satisfied for 
even a single mission proves to 
be a challenge almost every time. 
Some highly unusual constraints 
have impacted the scheduling of 
launches. For example, during the 
Japanese fishing season off the coast 
of Tanegashima, large numbers of 
fishing vessels are situated off the 
waters of the launch site, which 
would put people at risk if a rocket 
exploded. Another constraint was the 
estimated pressure in the off-nominal 
case of an explosion of the vehicle 
near the Mid-Atlantic Regional 
Spaceport in Virginia. Yet another 
was the G8 summit in Arkalyk, 
Kazakhstan, and the associated air 
space restrictions over Kazakhstan 
during the arrival of all the Heads of 
State. This situation prohibited the 
Russian search-and-rescue aircraft 
from conducting the Soyuz recovery 
mission on the original date. Other 
constraints have included the sea state 
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“Piece by Piece; Step by Step” 

Jeff Williams, STS-101, ISS Expeditions 13,21,22,47,48 


Among the most impressive—and sometimes 
overlooked —aspects of the history of the ISS assembly 
and ongoing operations are the visiting vehicles 
necessary to build and sustain the space station. 
Napoleon Bonaparte is credited with the quote, 

“an army marches on its stomach,” emphasizing the 
criticality of logistics to ensure mission success of a 
deployed military. The same is true of the space station 
and her continuously deployed crew. As of mid 2017, 

178 rocket launches were dedicated to building, manning, 
and maintaining the ISS. 

Food, of course, is just one element of the vast logistics 
train necessary in keeping the ISS and its crew going 
strong over the many years away from the planet. 

My first visit to the orbital outpost on a Space Shuttle 
crew in 2000 was, in part, dedicated to stockpiling 
the supplies and equipment necessary to prepare for 
the arrival of Expedition 1. Over the years since, during 
long-duration expeditions to the growing complex, 

I experienced visits by four additional Space Shuttles and 
stays of seven Soyuz spacecraft besides my own three, 
and I watched eight Progress, one HTV, one Cygnus, and 
two Dragon spacecraft come and go. Food —including 
fresh fruits and vegetables and, occasionally, even ice 
cream—was present on every vehicle. So was clothing, 
general supplies, repair parts and tools, large and small 
elements of the growing complex, science and research 
experiments, new technology demonstrations, and even 


“cards and letters” from home. Several of the shuttles and 
Russian rockets delivered major components of the ISS, 
including module and truss elements. Most significantly, 
the Space Shuttles and Soyuz spacecraft enabled the 
coming and going of crewmates. 

Spaceflight is inherently hard, and access to space from 
Earth and the return to Earth are particularly hard phases. 
That is what makes the ISS visiting vehicle story so 
impressive. The loss of several supply ships during the 
launch and ascent phase gives testimony to the particular 
challenge of sustaining the orbital outpost. The loss of our 
friends on the Space Shuttle Columbia, which grounded 
the fleet during the ISS assembly, makes it a particularly 
human challenge. 

What we have learned from the critical role of visiting 
vehicles and the logistics train supporting the ISS will 
be an essential enabler for future exploration beyond 
Earth orbit. We will, of course, improve regenerative 
efficiencies for things such as water and atmosphere, and 
we will even find ways to draw from natural resources at 
the location of future destinations. However, there will 
always be a dependency on resources and consumables 
from Earth, especially those required for life support. 
Regardless of future ends in space exploration, launching 
and returning vehicles will always be among the required 
means to accomplish the goals and objectives. As with 
the space station, that will be piece by piece, step by 
step, by way of visiting vehicles. 


in the Pacific Ocean off the coast of 
California so that a vehicle could land 
safely and be recovered, the position 
of the sun relative to the ISS orbit 
(known as the beta angle) due to the 
impact of lighting on key sensors 
on a spacecraft, and the failure of 
an external pump on the ISS that 
took out cooling to half of the space 
station—including the equipment 


needed for safely berthing a vehicle. 
Because of the number of constraints, 
it is common for the dates of a 
visiting vehicle mission to change 
several times. Operationally, this can 
mean planning the mission multiple 
times prior to execution. Once the 
international community sets a date 
for a mission, the preparations begin. 


Flight Controller Training 

A flight-specific team of controllers 
will be assigned to each visiting 
vehicle mission no later than 
approximately 6 to 8 months ahead of 
the scheduled event. A team of flight 
controllers, led by a flight director, 
will be at MCC-H, and a team of 
flight controllers will be at the home 
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control center of the visiting vehicle. 
These teams will spend months 
preparing procedures and flight rules 
to govern the real-time execution 
of the mission. The team will also 
simulate the operations multiple 
times to ensure the procedures 
and rules are correct, the timing 
and communication between the 
control centers is perfect, and the 
ground equipment that allows the 
control centers to share data and 
voice communication is operational 
(see Chapter 10). The simulations, 
conducted jointly between NASA 
and the home control center for the 
visiting vehicle, generally occur 
between launch minus 6 weeks and 
launch minus 2 weeks. 

When the approaching visiting 
vehicle enters the real-time phase 
of the mission known as Joint 
Operations, the mission authority 
transfers from the home control 
center of the vehicle to MCC-H, 
except in the case of Russian vehicles 
when the MCC-M is in charge. The 
home control center retains vehicle 
authority and is responsible for 
configuration and performance of the 
vehicle. NASA is responsible for the 
overall safety of the ISS crew, the 
safety of the ISS, and the mission 
objectives. Within Joint Operations, 
all decisions to proceed to the next 
phase of the mission (known as 
“go/no go” decisions) are made 
by the flight director in MCC-H 
after consultation with the mission 
director at the home control center. 
These roles and responsibilities are 
stressed during the training so that 
decisions can be made accurately and 
expeditiously during the real-time 
execution of the mission. 


Crew Training 

The crew on board the ISS has a 
critical role in the execution of a 
visiting vehicle mission. The crew will 
monitor the incoming vehicle, starting 
at a range of approximately 1000 m 
(3281 ft) relative to the ISS. The crew 
is given specific parameters to monitor 
and actions to take if the vehicle 
violates preset criteria. The crew 
monitors the vehicle range relative to 
the ISS, the range rate or speed, and 
the position of the vehicle relative to 
the space station. If precisely defined 
criteria using these parameters, 
previously worked out between the 
two flight control teams, are violated, 
the crew can issue a command to the 
incoming vehicle over the ship-to- 
ship link (see Chapter 13) to have it 
hold its current position, retreat to a 
preset previous position, or perform 
an abort and fly away from the ISS. 
This monitoring is critical to prevent a 
collision between the visiting vehicle 
and the ISS. For example, each 
visiting vehicle will move toward 
the ISS within the approach corridor, 
which is a cone with its apex centered 
on the destination point of the visiting 
vehicle. The ISS crew will issue a 
command for the visiting vehicle to 
abort its rendezvous and move away 
from the station if the spacecraft goes 
outside of this corridor, thus indicating 
that the control system is not working 
properly and the ISS is at risk of a 
collision if the trajectory worsens. 

The home control center of 
the vehicle is responsible for 
commanding the vehicle to advance 
toward the ISS after receiving the 
appropriate approval or “go” from 
the flight director at MCC-H. Once 
the incoming berthing vehicle 
reaches a predetermined position— 


about 11 m (36 ft) underneath 
the ISS—it will hold its position 
relative to the space station. At this 
point, the visiting vehicle and the 
ISS are flying in formation. The 
crew will use the SSRMS to grab 
the visiting vehicle. This is known 
as the capture operation. As they 
do with a module, the astronauts 
will maneuver the robotic arm end 
effector and capture a grappling pin 
on the hovering vehicle. The capture 
needs to be performed precisely so 
as to avoid knocking the vehicle and 
thereby causing it to spin and move 
uncontrolled in close vicinity of 
the ISS. Once captured by the arm, 
the vehicle automatically goes to 
what is known as free drift, which 
means it is no longer firing any of its 
thrusters. This allows the SSRMS to 
maneuver the vehicle to its berthing 
port without damaging it through an 
unexpected push or pull by a thruster. 
See also Chapter 15. 

The crew procedures, displays, data, 
and training need to be near perfect 
because of the close interaction 
between the crew and the flight 
control teams on the ground and the 
tight timeline choreography. Crew 
members are trained on the ground 
before they begin their mission on 
board the ISS. About a week prior 
to the arrival of the visiting vehicle, 
crew members conduct their refresher 
on-board training as it likely has been 
many months since they received 
training on the ground. The crew 
uses a robotic arm computer-based 
simulator to practice moving the 
SSRMS in and capturing the visiting 
vehicle. In the days leading up to 
the arrival of the vehicle, the crew 
will practice the capture operation 
over and over again on a laptop 
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computer simulator, which includes 
hand controllers to replicate the 
grappling with the robotics system 
in preparation for the real operation. 
The crew members will also review 
their monitor procedures, criteria to 
take action, and the actions. The crew 
and the flight controller teams will 
conduct a conference led by the flight 
director about 1 to 2 days prior to the 
arrival of the vehicle to make sure 
everyone is ready for the operation. 


Cargo Delivery and Loading 

As the flight control teams prepare 
the mission, the cargo teams finalize 
the list of cargo to fly on the visiting 
vehicle. The supplies on the ISS, 
including spare or replacement 
parts, are meticulously tracked and 
resupply schedules are set and reset 
on a continual basis. Time is also 
allocated for carefully packing the 
cargo on the spacecraft. Not only 
does it have to be meticulously 


packed to withstand the forces of 
the launch, but the mass has to be 
precisely balanced to ensure the 
vehicle flies correctly. Last-minute 
issues on board the ISS that require 
unplanned resupplies or new 
hardware are balanced against the 
mission schedule to determine what 
can be accommodated. Consumables 
such as food, water, and oxygen have 
to be very carefully managed. Not 
only are enough supplies needed, 


Are we there yet? 

As noted in Chapter 7, the ISS orbits the Earth at an 
altitude of about 410 km (255 miles) above the surface. 
About a dozen vehicles from various countries and 
organizations visit the ISS every year. 

When describing the physics that govern their rendezvous 
with the ISS, two principles should be considered- 
principles that are too complicated to go into here. First, 
Newton’s Law of Gravity says that gravity pulls on objects 
in lower orbits with more strength than it pulls on objects 
in higher orbits. Second, Kepler’s Laws of Planetary 
Motion say, in part, that objects traveling in lower orbits 
go around the Earth faster than objects in higher orbits. 

In planning orbital rendezvous, both principles need to 
be considered simultaneously. In short, the process is 
similar to the case of a police officer who is sitting at the 
side of the road, looking for speeders. The officer cannot 
leave his or her observation spot (i.e. “launch”) until the 
speeding car passes. Once this happens, the officer has 
to catch up—first accelerating to higher speeds to close 
the gap and then gradually slowing to match the speed 
of the car he or she is pursuing. If the officer doesn’t slow 
down and match the speed of the other car, he or she 
risks hitting it and causing damage. If the officer lets the 
car get too far ahead before pursuing, he or she may not 
have enough fuel to catch the speeder. If a cylinder on 
the car is misfiring or if the weather is bad, the officer will 
have to make additional driving adjustments. 


In the case of the ISS, the visiting spacecraft will launch 
when the ISS flies overhead. The vehicles are uncrewed 
and rendezvous with the ISS autonomously with guidance 
from the control center. During the mission, the Visiting 
Vehicle Officer monitors the maneuvers or burns of the 
spacecraft as it climbs to the orbit of the ISS, and then 
matches the speed for a capture by the robotic arm 
or gentle docking. The trajectory is updated as things 
change during rendezvous, which can happen if a thruster 
does not quite burn as expected or if atmospheric drag 
is different than expected due to variations in the sun — 
among a multitude of other reasons. Small burns may be 
added to the mission to compensate for these issues. 

To complicate matters, the rendezvous has to be timed 
precisely so that the sun does not blind cameras or crew 
members. This process can take as few as 6 to 8 hours 
but typically takes about 2 to 3 days. 

When the vehicle is in close proximity of the ISS, even a 
few meters a way, it is technically in a different orbit and 
therefore will move slightly differently than will the ISS. At 
this point, it is a little like keeping a balloon off the floor, 
Gravity will try to pull the balloon back to the Earth, but 
small upward taps with the hand will keep it in the air. 
Newton told us that the Earth will try to pull the visiting 
vehicle down faster than the ISS; however, thrusters are 
used to tweak the motion to keep it in close proximity. 

The visiting vehicle officers watch this dance very closely 
to ensure a successful rendezvous while the flight director 
ensures the ISS is ready for the new spacecraft. 
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extra materials have to be sent to 
the ISS to protect for the case when 
another cargo vehicle—or three, as 
mentioned above—cannot make 
it to the ISS. Once the manifest is 
finalized, the items are packaged 
and delivered to the visiting vehicle 
company for packing into the vehicle. 
The delivery of the cargo is usually 
staged. Items that are ready early are 
sent first. Usually, a late load of items 
accommodates last-minute changes 
to the manifest, or there may be 
science experiments that have strict 
timing constraints between launch 
and arrival on the ISS. Once the 
cargo has been loaded, the spacecraft 
has been declared ready, and the 
rocket has been declared ready, it is 
time to launch. 

Day of Arrival 

After a successful launch and orbit 
insertion, the visiting vehicle will 
spend 2 to 3 days catching up to the 
ISS. This is referred to as phasing. 
During this time, the home control 
center of the vehicle is in charge 
of the mission. The flight control 
team at the home control center 
(Figure 5) monitors the performance 
of the spacecraft and performs 
checkouts of the systems that will be 
used for the rendezvous with the ISS. 

The ISS Joint Operations commence 
as soon as the vehicle reaches 
approximately 35 km (22 miles) 
behind and 4 km (2.5 miles) below. 
MCC-H has mission authority 
from this point, and until the 
vehicle completes its mission and 
departs the ISS. Up to this point, 
the flight-specific team in MCC-H 
has monitored the progress and 
performance of the vehicle, reviewed 
data, and stayed in communication 



Figure 5. (Top) The flight control team supports a Dragon mission from the SpaceX Mission Control 
Center in Hawthorne, California. Photo from Space Corporation, which has waived all copyright and 
related or neighboring rights to this work. (Bottom) Image of the Orbital ATK Mission Control Center in 
Dulles, Virginia. 


with the team at the home control 
center of the vehicle. Joint 
Operations begins while the crew 
members are still asleep since the 
capturing and berthing process can 
take a significant portion of their 
day. During Joint Operations, the 


vehicle continues to move closer 
to the ISS and starts orienting its 
trajectory relative to that of the ISS. 
As operations progress into the start 
of the crew day, crew members on 
the ISS begin preparing for their 
monitoring role and the capture. 


DAY IN THE LIFE: VITAL VISITING VEHICLES-KEEPING THE REMOTE OUTPOST CREWED AND OPERATING CHAPTER 14 


241 


Photo courtesy of Ken Peek (Orbital ATK) used with permission by Orbital ATK 
















Figure 6. (Left) Expedition 41 crew member Alexander Gerst (ESA) as an operator controlling the SSRMS from the Cupola Workstation during the 4th SpaceX 
mission on September 23, 2014. The Dragon vehicle can be seen in the far right monitor in the image as it approaches the ISS. Astronaut Reid Wiseman 
floats behind Gerst and performs camera operations. (Right) Japan Aerospace Exploration Agency astronaut Koichi Wakata (top) and NASA astronaut Mike 
Hopkins, both Expedition 38 flight engineers and both wearing sunglasses, pose for a photo in the Cupola module while waiting for the Orbital-1 Cygnus 
arrival (in background) on January 12, 2014. The visiting vehicles, which have built-in hold points during their approach, will inch slowly toward the ISS while 
the flight control teams on the ground assess the performance of each spacecraft and its readiness to proceed closer. Photo was taken during Expedition 38. 


At a range of approximately 1000 m 
(3281 ft), the crew on board the ISS 
starts looking for the incoming 
visiting vehicle. Two crew members 
are situated in the Cupola module, 
looking down toward Earth. This 
is where they will conduct the 
monitoring and the capture operations, 
as shown in Figure 6. A backup work 
location is set up and ready in the 
US Laboratory Module in the event 
of a failure with the equipment setup 
inside the Cupola (see Chapter 15). 


As the crew monitors the approach 
of the visiting vehicle, the flight 
control teams on the ground review 
the performance data, assess the 
“go/no go” flight rules, and configure 
the systems both on the incoming 
spacecraft and on the ISS to faciliate 
a safe approach. The Joint Operations 
become more time critical and riskier 
as the vehicle gets closer to the 
ISS. The criteria for proceeding are 
tighter. When the vehicle successfully 


arrives at the capture point, SSRMS 
operations commence (Figure 7). 

To perform this complicated task of 
monitoring an approaching vehicle, 
capturing it, and then berthing, the 
astronauts rely heavily on the robotic 
systems of the station—especially 
the Robotic Workstation. External 
cameras provide critical views with 
additional graphics overlaid on the 
image. Those graphics, or overlays, 
are essentially a heads-up display for 



Figure 7. (Left) The robotic arm moves toward the unpiloted Japanese Kounotori HTV-4 as it approaches the ISS on August 9,2013. The HTV-4 is delivering 
3,600 kg (7936 lbs) of science experiments, equipment, and supplies to the orbiting complex. (Middle) Using the ISS robotic arm, seen at the right of the 
picture, NASA Flight Engineer Kjell Lindgren prepares to capture the Orbital ATK Cygnus cargo vehicle on December 9,2015. The space station crew and the 
robotics officer in MCC-H will position Cygnus for installation to the orbiting laboratory’s Earth-facing port of the Node-1 module. (Right) The SpaceX Dragon 
Commercial Resupply Services-3 spacecraft approaches the ISS for rendezvous and grapple during Expedition 39 on April 20,2014. 
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the crew, providing such things as 
joint angles, position and orientation, 
visiting vehicle approach data (e.g., 
range and speed), and caution and 
warning statuses. An example of this 
is shown in Figure 8. 

Under the direction of MCC-H, 
the crew captures the vehicle using 
the SSRMS. After a point shortly 
following the capture, the crew 
turns over the SSRMS operations 
to MCC-H. Flight controllers in 
MCC-H will manuever the SSRMS 
and grappled vehicle to the assigned 
port—Node 1 or Node 2—and 
position the vehicle for berthing 
operations (Figure 9). 

The rendezvous, capture, and 
berthing operations, which take a 
number of hours, are conducted 
within a single crew day. The 
flight control team needs to stay 
on schedule to ensure the visiting 
vehicle is not stuck on the end of 
the SSRMS during the crew sleep 
period. The following day—and, in 
some instances, the same day—the 
crew will ingress the newly arrived 
visiting vehicle. Sometimes, a crew 
care package has been conveniently 
stowed where crew members have 
quick and relatively easy access. 

The care packages will contain some 
of the crew members’ favorites 
things. A popular care package item 
is fresh fruit. Sometimes, notes are 
included from the flight control team 
back in Houston, wishing the crew 
well on the rest of the mission. Crew 
members will spend anywhere from 
1 to several months unloading the 
cargo and stowing it on the ISS. As 
they unload the new cargo, they will 
also start filling the vehicle with 



Figure 8. An example of using graphics overlay to capture a visiting vehicle—in this case, the first 
SpaceX Dragon spacecraft to the ISS. This picture shows one of the Robotic Workstation monitors 
during capture operations for the Dragon vehicle during Expedition 31 (May 25,2012). The view of the 
ISS with the robotic arm and the incoming Dragon vehicle are provided by a camera mounted on the 
truss of the space station. The green lines, numbers, and letters define such things as a safe location 
for the spacecraft (e.g., the large green rectangle near top center) and the location where the vehicle 
is expected to be, as indicated by the green outline of the Dragon. These graphics are then overlaid on 
the video and shown to the crew member who is operating the arm. These overlays provide the crew 
member with real-time data about the Dragon, such as position and orientation, as well as outlining 
an imaginary approach corridor that the Dragon needs to maintain as it approaches the space station. 
Using overlays in this fashion allows the crew member to maintain situational awareness of the incoming 
vehicle without having to take his or her eyes off of the video showing the actual approaching vehicle. 



Figure 9. Flight controllers led by Flight Director Brian T. Smith (standing left of center in the third row 
from the front), supported the orbital work in the space station flight control room in Johnson Space 
Center’s Mission Control Center as the Canadarm2 berthed the Orbital ATK Cygnus commercial cargo 
craft to the Harmony node of the ISS on Jan. 12, 2014. 
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items to be disposed off or to be 
returned to Earth. See Figure 10. 

One to several months after arriving 
at the ISS, the visiting vehicle will 
depart and conclude its mission. 

The crew uses the SSRMS to grapple 
the vehicle and unberth it from the 
ISS. The crew then manuevers 
the SSRMS to the release position 
and releases the vehicle. The 
vehicle performs a short jet firing 
to initiate a flight trajectory away 
from the ISS, followed by a series 
of manuevers to either destroy itself 
upon reentry or safely land in the 
Pacific Ocean for retrieval. 

As elsewhere in the ISS Program, 
visiting vehicles have also evolved. 
Initially, it was envisioned that only 
one cargo vehicle at a time would 
berth to the US OS during a given 
period. It soon became apparent 
that as schedules shift, sometimes 
due to launch failures as noted 



Figure 10. Astronauts Karen Nyberg (center) and Chris Cassidy (left), Expedition 36 flight engineers 
work inside the ESA ATV-4 ‘Albert Einstein” while docked with the station. ESA astronaut Luca 
Parmitano (right), flight engineer, is taking the selfie. 


Timing is Everything 

As noted above, a great deal of planning is required to 
orchestrate the coming and going of visiting vehicles. 
Even with so much planning and training, the flight 
control team has to be ready at all times for problems 
and replanning. For example, a timing issue in September 
2013 between the ISS and the first Orbital ATK mission 
affected how the Cygnus calculated it’s relative position, 
thus causing an automated abort of the rendezvous. The 
rendezvous could not be immediately resumed since it 
took the flight control team some time to determine what 
had happened but also to allow for the docking of the 
Soyuz that carried the Expedition 37 crew. The uncrewed 
cargo vehicles have the ability to loiter for several days, 
whereas the priority is to get the crew to the ISS as 
quickly as possible. 


Similar flexibility with a twist was required in September 
2008 when the first ATV, called “Jules Verne,” was 
preparing to be undocked from the ISS. It was scheduled 
to undock on September 5 and a new Progress vehicle 
was scheduled to launch on September 10 and dock to 
the same port. However, MCC-H was in the process of 
shutting down to prepare for Hurricane Ike as it headed 
for Houston. The NASA flight control team worked quickly 
to safely complete the undocking. This scenario was 
never expected to occur during a hurricane, but the tight 
schedule required the team to adapt. Five days after 
conducting the successful undocking, NASA dispatched 
flight control teams to two different locations to set 
up one temporary (undisclosed location) and a more 
permanent (Marshall Space Flight Center in Huntsville, 
Alabama) backup ISS control center in advance of 
evacuating MCC-H. Both were used. 
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Figure 11. A view from the external cameras on the ISS showing the capture and berthing at Node 2 on April 10, 2016, of the SpaceX Dragon while the 
Orbital ATK Cygnus, which arrived previously on March 26, is parked on the nadir side of the Node 1 module. 


above, missions might overlap. 

More flexibility would be possible 
if two places were available for the 
cargo craft to berth on the USOS. 
After a significant amount of work, 
a second berthing port was added to 
the nadir side of the Node 1 module 
in addition to the one already present 
on the nadir side of Node 2. In the 
spring of 2016, two vehicles—a 
Dragon and Cygnus—were berthed 
to the space station at the same time, 
as seen in Figure 11. 

More to Come 

As with the ISS itself, vehicles that 
visit the space outpost are evolving 
as well. NASA purchased the 
services of the private companies 
SpaceX and Orbital ATK that build 
the Dragon and Cygnus vehicles, 
respectively, under the Commercial 
Resupply Services (CRS) contract, 
which was awarded in 2008. In 
January 2016, NASA announced 
the second phase of the supply 
missions, known as CRS-2. In 
addition to SpaceX and Orbital 
ATK, NASA selected Sierra Nevada 
Corporation, which is building 
the Dream Chaser spacecraft 


(Figure 12), to provide cargo 
missions. Sierra Nevada Corporation 
is expected to fly the first Dream 
Chaser mission in 2020. 

Following the retirement of the 
Space Shuttle, the ISS became 
completely dependant upon 
the Russian Soyuz to transport 
astronauts to and from the space 
station. Beginning in 2010, NASA 


partnered with commercial aerospace 
companies to develop crew 
transportation subsystems, followed 
by later development phases—an 
approach that was modeled after 
the successful CRS program. In 
September 2014, NASA selected two 
companies—Boeing and SpaceX— 
to develop the CST-100 Starliner 
and Crew Dragon, respectively, for 
this task. The first flight tests are 



Figure 12. The Dream Chaser cargo vehicle, to be developed by Sierra Nevada Corporation, berthed to 
the nadir port of the Node 2 module. It is estimated to fly in 2020. 
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anticipated to take place in 2018. 

See Figure 13. These new crew 
spacecraft will be able to carry up 
to four astronauts to and from the 
space station, which would bring the 
station crew size up to seven. 

Unlike the cargo vehicles, which 
berth, the new crewed spacecraft will 
dock using a newly developed NASA 
Docking System. Cargo is often 
bulky, especially if a full payload rack 
is being sent to the ISS; therefore, 
these uncrewed cargo vehicles use the 
wider Common Berthing Mechanism 
described in Chapter 3. However, 
the crewed vehicles will not be 
transporting large pieces of cargo, 
and they must be able to quickly get 
away without requiring the robotic 
arm since the vehicles will also serve 
as the emergency lifeboat for the 
crew. SpaceX will control its Crew 
Dragon vehicle out of its Mission 
Control Center facility in Hawthorne, 
California. Boeing, partnered with 
the Flight Operations Division at 
Johnson Space Center, will operate 
the Starliner out of one of the control 
rooms in Houston that is known as 
Mission Control Center CST-100. 


Conclusion 

Although the ISS is a technical 
marvel, having been built by multiple 
countries through many launches, 
supplying the remote outpost has 
been critical to its survival. When 
Space Shuttle Columbia was 
destroyed during reentry in 2003, 
the ISS had to reduce the number 
of resident crew members from the 
limit of three (at the time) to two. 
This was because the only cargo 
vehicle available was the Russian 
Progress spacecraft, which could 



Figure 13. CST-100 Starliner (top) and Crew Dragon (bottom) approach the forward docking port on 
the Node 2 module. 


carry enough supplies for only two 
people. Today, four different vehicles 
can transport cargo to the ISS. As of 
2015, more than 30 cargo missions 
have flown by the fleet consisting of 
the European ATV, the Japanese HTV, 
and the American Cygnus and Dragon 
vehicles. The new cargo craft—the 
Dream Chaser—should be added in a 
few years. 
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Chapter 15 Systems: 

Robotics— 
the Construction 
Equipment for 
the International 
Space Station 




An image of the Canadian five-dollar bill features a spacewalker wearing a Canadian flag on the shoulder, the International Space Station robotic arm, and the 
Special Purpose Dexterous Manipulator. 


Brains, voice, heart, lungs, and 
circulation system—all are critical 
for life . The International Space 
Station (ISS) requires the technical 
versions of such systems, as well. 
Just as important are “limbs”— 
most notably, the giant robotic arm 
of the space station . The robotic 
arm is fundamental for executing 
spacewalks, conducting repairs, and 
performing cutting-edge research. 
The ISS would not exist without this 
limb, which played a key role during 
construction of the space station. 

For 15 years, the ISS was essentially 
a construction site, albeit one that 
orbited at 28,163 km/h (17,500 mph). 
As with any construction site, cranes 
are required to move large pieces 
into place. The focal point of space 
station assembly “job site” was the 
main robotic arm. This machine, 
measuring 17.6 m (57.7 ft) in length, 
moved massive objects such as 
large pressurized modules and truss 


segments, as well as transported 
spacewalkers to areas that would 
otherwise be unreachable. The arm 
is part of a complex system that is 
extremely flexible, allowing the 
arm to move to different work sites, 
grab other arms that can do fine 
detail work, and even repair itself. 

In fact, because of this flexibility, the 
entire system is known as the Mobile 
Servicing System (MSS). 

This chapter focuses on the MSS; in 
particular, the space station crane (i.e., 
the Space Station Remote Manipulator 
System) and the components that 
make up the supporting equipment 
(i.e., Special Purpose Dexterous 
Manipulator [SPDM], Mobile 
Transporter [MT], and Mobile 
remote server Base System [MBS]). 
Operation of the MSS is discussed, 
which will explain how the crew 
and a blended NASA and Canadian 
Space Agency flight control team 
work together. The evolution of 


this symbiotic relationship is also 
presented, as well as some of the 
challenges that the flight control team 
has faced over the years, beginning 
with the birth of the systems during a 
time of crisis. Since its activation, the 
robotic arm has played a critical role 
in increasingly complex operations. 

The Japanese contributions of robotic 
systems are the Japanese Experiment 
Module Remote Manipulator System 
Main Arm and the Small Fine Arm. 
The European Robotic Arm is 
scheduled to be installed in or around 
2018. Activation and operation 
of this arm is tied to the arrival 
of the Russian module called the 
Multipurpose Laboratory Module 
(see Introduction). As with other 
systems provided by international 
partners, these are not discussed 
further here. This chapter, however, 
focuses on the Canadian-built robotic 
system. Collectively, the components 
are called the MSS. 
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Robotic Systems on the 
International Space Station 

As part of a longstanding partnership 
between NASA and the Canadian 
Space Agency (CSA), Canada’s main 
contribution to the ISS has been the 
robotic systems. Canada already had 
an established capability in space 
robotics. The Canadian government 
managed and funded the design of the 
Shuttle Remote Manipulator System 
(SRMS), commonly referred to as 
Canadarm. The first shuttle-based 
Canadarm was launched on Space 
Transportation System (STS)-2 in 


November 1981, with operational 
responsibility residing with the 
NASA Flight Operations Directorate. 
After President Ronald Reagan’s 
invitation in 1984 for international 
friends and allies to participate in 
the Space Station Freedom Program, 
Canada chose to contribute a suite 
of robotics elements that would be 
critical to space station assembly and 
maintenance. The formal agreements 
were signed between the United 
States and Canada on September 29, 
1988—the same day the space shuttle 
returned to flight following the post- 
Challenger hiatus. 


The centerpiece of the ISS MSS is the 
Space Station Remote Manipulator 
System (SSRMS), dubbed 
Canadarm2 by the CSA. Since it is 
larger than the shuttle arm by 2.0 m 
(6.6 ft) and wider by 2.0 cm (0.8 in.), 
it is also referred to as the “big arm.” 
Although similar to the shuttle arm in 
many respects, the new space station 
arm represented an evolutionary 
step forward. Table 1 lists the key 
characteristics of the SSRMS with 
an overview of the MSS shown in 
Figure 1. 

Early assembly of the ISS (including 
supporting spacewalks) was 


Table 1. Summary of the SSRMS properties, based on data provided by CSA (http://www.asc-csa.gc.ca/eng/iss/canadarm2/c1-c2.asp). 


Detail 

International Space Station Mobile Servicing System (Canadarm 2) 

Mission Profile 

Permanently in space. 

Range of Motion 

Moves end-over-end to reach many parts of International Space Station in an inchworm-like 
movement; limited only by number of Power and Data Grapple Fixtures (PDGFs) on the station. 
PDGFs located around the station provide power, data, and video to the arm through its Latching 
End Effectors (LEEs). The arm can also travel the entire length of the space station on the Mobile 
Base System. 

Fixed Joint 

No fixed end. Equipped with LEEs at each end to provide power, data, and video signals to arm. 

Degrees of Freedom 

7 degrees of freedom. 

Much like a human arm: shoulder (three joints), elbow (one joint), and wrists (three joints). 

However, Canadarm2 can change configuration without moving its “hands.” 

Joint Rotation 

Full joint rotation. 

Joints (7) rotate 540 degrees. 

Larger range of motion than a human arm. 

Senses 

Force moment sensors provide a sense of touch. Automatic self-collision avoidance. 

Length 

17.6 m (57.7 ft) 

Weight 

1,800 kg (3,968 lbs) 

Diameter (exterior diameter of 
composite boom) 

35 cm (13.8 in.) 

Mass Handling Capacity 

116,000 kg (255,736 lbs)—design case handling payload. 

Speed of Operations 

Unloaded: 37 cm /sec (1.21 ft /sec) 

Loaded: Station Assembly—2 cm/sec (.79 in./sec) 

EVA Support—15 cm/sec (5.9 in./sec) 

Orbiter—1.2 cm/second (.47 in./sec) 

Composition 

19 plies of high strength carbon fiber—thermoplastic 

Repairs 

Designed to be repaired in space by replacing Orbital Replacement Units. Built-in redundancy. 

Control 

Ground operation or astronaut control 

Cameras 

Four color cameras (one at each side of the elbow, the other two on the LEEs) 
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Figure 1. This artist’s rendering shows the robotic equipment discussed in the chapter. The SSRMS 
is outlined in orange. The Robotics Workstation (RWS) is outlined in blue. (Note: in this graphic, the 
pressure shell of the US Lab is cut away to show the location of one RWS. The second RWS is located 
in the Cupola attached to Node 3 [the blue dome near the white SSRMS.]) The MBS is outlined in 
green. The Mobile Transporter and rails are outlined in purple. The SPDM is outlined in yellow. 



Figure 2. This photograph, taken from the space station during rendezvous operations, shows the 
Space Shuttle Endeavour payload bay. The SSRMS, in its launch configuration, is seen folded up on a 
pallet (outlined in yellow) in front of the Raffaello Multi-Purpose Logistics Module (MPLM). For scale, 
the MPLM is 6.6 m (21.6 ft) in length and 4.6 m (15.1 ft) in width. During the mission, the shuttle arm 
removed the pallet with the SSRMS from the payload bay and installed it on the ISS. Spacewalking 
astronauts later unfolded the arm. The first payload ever handled by the SSRMS was the pallet on 
which it flew. The SSRMS removed the pallet from the space station. The pallet was then handed back 
to the shuttle arm, which placed it in the shuttle payload bay for return to Earth. 


performed using the shuttle arm. 

This included installing the Port 6 
(P6) and zenith (Zl) truss segments 
on STS-97/ISS-4A and the laboratory 
module on STS-98/ISS-5A. The 
SSRMS did not arrive on the space 
station until STS-100/ISS-6A in 
April 2001 (Figure 2). Even after 
the SSRMS arrived, the shuttle arm 
was often used to hand, back and 
forth, modules and other equipment 
going to, or returning from, the ISS 
(Figure 3). 

Space Station Remote 
Manipulator System 

The core part of the station robotic 
systems is the SSRMS, shown in 
Figure 4. The SSRMS elbow joint 
(the joint in the middle of the arm) is 
offset, or side-by-side, which allows 
for greater mobility. For comparison, 
human arms are attached to the 
shoulder with “in-line” joints. If the 
elbow is bent, a person can touch 
a finger to his or her shoulder, but 
can’t rotate past the point where 
the forearm touches the bicep. The 
Canadarm also had joints that could 
rotate only up to 160 degrees. The 
amount of possible rotation depended 
on the joint. The offset elbow joint 
of the station arm allows the booms 
on the arm (the “forearm” and the 
“bicep”) to rotate past each other. The 
joint can rotate a total of 540 degrees. 
The pitch and yaw joints at the end 
of the booms are also offset and have 
540 degrees of rotation, with the yaw 
joint being slightly longer to help 
reduce the chance of the arm hitting 
itself in what is known as a self¬ 
collision. The final joint on either 
end of the arm, underneath the end 
effector, is called a roll joint. The roll 
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Figure 3. During STS-132/ 
ISS-ULF4 in 2010, Space 
Shuttle Atlantis delivered the 
Russian Rassvet (‘‘Dawn’) Mini 
Research Module (MRM)1 
to the space station. In this 
picture, which was taken during 
the mission, MRM1 has been 
removed from the payload bay 
by the shuttle arm (bottom). 

The station arm (closer to the 
camera) is also grappled to 
the module. The manipulators, 
controlled by astronauts inside 
both the space station and the 
shuttle, are performing what is 
called “handoff” between arms. 
The station arm subsequently 
installed MRM1 on the Russian 
Segment of the ISS. 



End B {black stripe) 


Figure 4. Drawing of the station arm showing offset joints and the positive direction of motion for each of the seven joints is shown by the blue arrow. 
The direction in which each of the five joints can rotate is shown in blue. A black band is seen at the end of Boom B to differentiate one of the ends. 
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joints cannot be offset with anything; 
however, as with the other joints, 
they have 540 degrees of motion. A 
large black stripe is located on one 
of the booms (Boom B) since either 
end can be fixed to structure while 
the other end is used to manipulate 
an object. The boom at the other 
end is referred to as Boom A. Four 
cameras—one at each end and two 
at the elbow (not shown)—allow 
the operator to see what is being 
grappled and help prevent collisions 
between the arm and structure. 

One of the most critical parts of the 
arm is the Latching End Effector 
(LEE). A LEE is located on each end 
of the arm. One LEE allows the arm 
to grab payloads while the other acts 
as “base” for the arm when attached 
to the space station (Figure 5). 

The LEE is similar in size and shape 
to a barrel with the lid removed. 

Four latch mechanisms, an 
attachment point of an extravehicular 
activity (EVA) boot plate that 
allows an astronaut to attach to the 
arm (See Chapters 17 and 18), and 
a camera with a light are all situated 
around the outside of the LEE. 

Grabbing or attaching payloads is 
accomplished using a combination 
of snares and latches. The snares are 
braided wire ropes on a rotating ring. 
When the inner ring is rotated, the 
snares form a web across the open 
end of the LEE (Figure 6). 

To capture a payload, the snares 
close across a metal rod called a 
grapple shaft on the grapple fixture. 
An operator maneuvers the LEE so 
that the grapple shaft is inside the 
open cavity of the LEE. The snares 
close around the grapple shaft 
and a semisphere on top of the pin 
prevents the rod from sliding out of 



Figure 5. 4 LEE. The lights on top of the camera are to the right in this image. The EVA attach 
point allows a spacewalking astronaut to attach a foot restraint, attach his or her boots, and "ride” 
the arm (see Chapters 17 and 18). The snare cables in this image are completely open and fit flat 
against the opening. 


the snares. The three lobes (Figure 7) 
in the grapple fixture align with the 
indentations of the LEE, thereby 
allowing the arm to snuggly align to 
the base of the grapple fixture. The 
arm has a strong hold on the payload 
once the carriage has retracted and 
the back plate of the grapple fixture 
is tight against the face of the LEE. 
Some grapple fixtures (Figure 7) 
have additional features that the 
SSRMS can latch onto, which can 
provide power and data. This special 
type of grapple fixture is called a 
Power and Data Grapple Fixture 
(PDGF). Behind four small, spring- 
loaded doors are electrical, data, 
and video connections. A PDGF also 
has an outer ring on the baseplate. 
This outer ring is composed of many 
small teeth called a curvic coupling. 
A matching set of teeth are located 
on the LEE (Figure 5). As a PDGF 


is grappled, the curvic coupling 
enables precise alignment between 
the LEE and the grapple fixture, 
thus allowing for various service 
connections to be made. When the 
arm grapples a PDGF, umbilicals 
are extended from the LEE, which 
will pass through the protective 
doors and connect to power, data, 
and video. 

The ability to provide power, data, 
and video through a PDGF to the 
arm is major component of the 
mobility in the MSS. Several PDGFs 
are positioned around the ISS. 

These PDGFs, coupled with the 
LEEs, allow the SSRMS to reach 
worksites that a fixed robotic arm 
could not. The arm is connected 
to a PDGF at both ends to change 
locations. One end is then released 
and moved to another PDGF. This 
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Figure 6. (Left) Looking down the open end of the LEE, showing the snares in their open position. A ring that is holding the snares begins to rotate when 
the robotic arm is over a grapple pin (Figure 7), thus causing the snares to trap the rod. (Right) In this image, the inner snare mechanism has rotated, thus 
causing the LEE snare cables to form a i web across the opening. 


can be repeated multiple times 
to move the arm around. In the 
vernacular, the arm is designed 


to “walk” much like a Slinky® 
toy (Poof-Slinky, Inc., Plymouth, 
Michigan) or an inchworm. 



Figure 7. A PDGF. The grapple shaft is in the center with the white semisphere at the end. The three 
gold lobes align with identical indentations on the LEE to help align the arm. A black-and-white target 
allows the operator, using a camera at the end of the LEE, to make sure the arm is directly over the pin. 
Note the curvic coupling (gear teeth) and the four doors. 


Special Purpose Dexterous 
Manipulator 

Another robot on the ISS, the 
SPDM (Figures 1 and 8), arrived 
on STS-123/ISS-1J/A in 2008. 

The SPDM is comprised of several 
components, including a LEE, a 
Power Data Grapple Fixture, two 
robotic arms, a tool holster, and a 
stowage platform. The fine control 
of the SPDM arms facilitate the 
manipulation of various hardware 
components on the outside of the 
ISS, thereby allowing for a number 
of operations that do not require 
a spacewalking astronaut. For 
instance, the SPDM allows the 
replacement of failed components 
such as the Remote Power Control 
Modules (see Chapter 9). 

To change out failed items such as 
Remote Power Control Modules, 
the SSRMS first retrieves the 
SPDM from wherever it is currently 
stowed and maneuvers it close to 
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Figure 8. This drawing of the SPDM shows the individual elements including the LEE, where it can be 
mounted, or a PDGF, where it can be grappled by the arm. 



Figure 9. This picture shows the MBS right after it was delivered to the space station on STS-111/ 
ISS-UF-2. Note the four PDGFs, one of which has the arm attached, the Payload Orbital Replacement 
Unit Accommodation, the Mast Camera and the Umbilical Mating Adapters mated at a worksite. The 
MBS Common Attach System similar to the UCCAS is also shown. See also Chapter 3. 


a Cargo Transportation Carrier, 
which contains a spare unit. Using 
one of its arms, the SPDM opens 
the container and retrieves one of 
the new Remote Power Control 
Modules. The other arm would then 
close the container. A similar process 
is repeated at the site of the failed 
component to swap units, and then 
again to return the failed unit to a 
storage location. 

Mobile Remote Servicer Base 
System and Mobile Transporter 

In addition to “walking” around 
the station, the SSRMS can also 
hitch a ride and be carried along 
the truss. The MBS is a workbench 
for the SSRMS and SPDM 
(Figures 1 and 9). It contains four 
separate PDGFs that can be used 
as base points for either system. 
Depending on whether the operation 
to be performed is port or starboard, 
zenith or nadir, one of the four base 
points will be ideal for the activity. 

The MBS sits atop and is 
permanently attached to the NASA- 
built Mobile Transporter. A set of 
“tracks” is built in along the forward 
face of the ISS truss structure. 

These tracks allow the transporter 
with the MBS to move up and down 
the truss. Often, the transporter 
is moved to a different worksite, 
as seen in Figure 10, so that the 
SSRMS can reach some area of the 
space station. For those moves, the 
SSRMS and/or the SPDM are first 
attached to the MBS (Figure 11) and 
the transporter relocates everything 
to a new worksite. However, the 
transporter cannot stop at just any 
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FORWARD 




Figure 10. Locations where the Mobile Transporter can park along the truss of the ISS are listed as Worksite (W)1 through W8. W1 is located on the 
Starboard 3 (S3) truss segment. Worksites WO and W9 are not shown and would be on the S4 and Port 4 (P4) trusses, respectively. 

location along the truss. It can stop 
and “plug in” to the power and 
data networks at specific locations. 
Altogether, there are 10 transporter 
worksites on the ISS numbered 
0 (WO) through 9 (W9), but only 
eight of them are actually used. The 
last two worksites (WO and W9) 
are located outboard of the Solar 
Array Rotary Joint (see Chapter 9). 
The rails were never installed on 
those outer segments; thus far, those 
outboard worksites have never been 
required for operations. 


Figure 11. This picture taken during Expedition 26 shows the SSRMS based on an MBS PDGF holding 
the SPDM, which is attached to an Orbital Replacement Unit. The Payload Orbital Replacement Unit 
Accommodation (POA) is also holding another Orbital Replacement Unit. 



KUA IS 

holding a 
piece of 
hardware 


SSRMS is holding 
the SPDM, which 
is holding another 
piece of hardware 


SSRMS is 
attached to 
an MBS PDGF 
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Mobile Servicing 
System Operations 

Operations of the robotic systems 
are unique in a number of aspects 
and, much like the ISS, have evolved 
over the years. On the Space Shuttle, 
the Canadarm was controlled by 
the astronauts, which was the initial 
plan for the MSS. Today, the ISS 
systems can be operated by either 
the astronauts or the flight control 
team based in Houston or Montreal. 
Where possible, it is preferable 
to perform operations from the 
ground to free up the astronauts 
to focus on scientific research. 

Crew Operations and the 
Robotic Work Station 

The crew interface to the robotic 
systems is the Robotics Work Station 
(RWS).The ISS includes two identical 
RWSs (Figures 1 and 12). One is 
located in the Laboratory Module 
and the second is located the Cupola. 


Their key components include a 
control panel, two hand controllers 
for control of the arm, and three video 
displays to provide camera views to 
the astronaut operator. The control 
panel controls key functions such as 
how fast the arm can move and which 
of the many external cameras are 
visible on one of the three monitors. 

Two hand controllers are located 
on each work station. These allow 
crew members to control arm motion 
and perform capture-and-release 
operations. A crew member who 
maneuvers the arm via the RWS 
hand controllers is said to be “flying 
the arm.” 

The monitors are used to provide 
situational awareness cues to crew 
members while they are operating 
the system. Several cameras on the 
ISS structure and several cameras on 
the robotic system can be displayed. 
When grappling a free-flying 
spacecraft, for example, the crew 
members will display the camera 


that is mounted on the tip of the 
arm, which allows them to see visual 
cues about the alignment of the end 
effector relative to the grapple pin. 

If the robotic system is being used to 
maneuver a spacewalker, a camera 
on the ISS structure might be used 
to monitor how close his or her boot 
plate is to the station structure. 

Ground Operations and the 
Flight Control Team 

Unlike robotic arms that move fast 
and easily, such as those in science 
fiction movies, the motion of the 
space station systems requires long 
and careful planning by the Robotics 
Officer (ROBO) team. If the operation 
is something that can be performed 
methodically, such as replacing a 
piece of hardware on the exterior of 
the ISS, and which can be planned 
well in advance, the flight control 
team will perform the operations; 
otherwise, the crew may perform the 
task. For more dynamic operations— 



Figure 12. (Left) Expedition 18 Commander Michael Fincke (left) and STS- 126/ISS ULF-2 Mission Specialist Donald Pettit (right) work the controls at 
the RWS in the US Laboratory on November 17,2008. The three monitors in the middle can be used to view any external camera on the ISS. Additional 
computers are used to display a graphical representation of the arm or video from other sources (e.g., from the shuttle payload bay). The laptop that Don 
Pettit is using displays the timeline and procedures. Today, the Laboratory RWS is only used as a backup for the one in the Cupola. (Right) Expedition 36 
Flight Engineer Karen Nyberg prepares to capture the "Kounotori” H-ll Transfer Vehicle-4 on August 9, 2013. Her hands are on the two-hand controllers and 
the three video monitors are at her eye level with a laptop in the center showing the joint angles of the robotic arm. The tip of a solar array is visible in the 
window on the right while the robotic arm is seen in the window on the left. 
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Figure 13. Expedition 47 ROBO Jason Dyer (CSA) on console in Mission Control Center-Houston during rendezvous with Orbital/ATK Cygnus OA-6 cargo 
vehicle in March 2016. Various data are displayed on the computer monitors including a graphical display below the ROBO sign on the left, similar to what 
the astronauts use, showing the current position of the robotic arm. On the left side of the front wall displays are six images from external cameras on the 
ISS. The middle wall display tells the flight director (not shown) the location of the ISS in relation to the Earth, as well as the vehicle orientation. The far-right 
display shows the commands being sent to the ISS and any alarms that are present. 


e.g., capturing a visiting vehicle or 
supporting a spacewalk—the on-board 
astronauts will execute the procedure. 

In addition to providing the hardware, 
CSA also provided flight controllers 
to operate the MSS. Whereas the 
other international partners control 
their contributions from a control 
center in their host countries with 
their own flight director, the MSS 
is controlled from Houston, Texas, 
under the supervision of the NASA 
flight director. In Houston, the 
system team, led by the ROBO 
(see Introduction) is made up of 
approximately 50% CSA employees. 
Initially, the CSA robotics support 


room in Montreal provided primarily 
engineering support during robotics 
operations, which was the equivalent 
of the Mission Evaluation Room 
discussed in the Introduction. Over 
time, the capabilities of the facilities 
and operators in Montreal grew. 
Today, it now serves as a control 
center. Here, the MSS systems and 
MSS task flight controllers support 
the ROBO (Introduction Figure 10) 
and, on occasion, ROBO supports 
from Montreal with the backroom 
support in Houston (Figure 13). 

In the early days of robotic operations 
on the ISS, the flight control team 
powered the MSS on or off but 


left the dynamic operations to the 
crew. After a serious ISS computer 
system failure on STS-100/ISS-6A 
(see below), the team began to 
imagine how operating the robotic 
systems from the ground could 
actually work. Today, many of the 
SSRMS operations, all translations 
of the systems using the Mobile 
Transporter, and all of the SPDM 
operations are actually performed 
by the ground team. The Bigelow 
Expandable Activity Module was 
installed in April 2016, completely 
by the ground team. The astronauts 
performed only the time-critical steps 
with the Common Berthing Module. 
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In 2004, the ground team uplinked 
approximately 3,500 commands to 
the MSS. This number is expected to 
rise to greater than 80,000 in 2018. 

Ground control does not employ 
hand controllers. Although the 
ROBOs could perform operations 
with hand controllers, the latency 
involved in issuing commands to 
the ISS via the Tracking and Data 
Relay Satellite System preclude them 
from performing the subtle motions 
required for operations using hand 
controllers. Therefore, personnel in 
the Mission Control do not “pilot” 
the arm like the crew does. Instead, 
flight controllers use pre-calculated, 
automatic sequences of instructions 
that tell each joint exactly how far 
to turn, at what rate, and in which 
order. During motion of the arm, the 
ROBO then monitors the system to 
verify it is executing the instructions 
correctly. These “ground control” 


operations use the various camera 
views available to Mission Control 
Center-Houston as well as computer 
depictions of where everything is 
in relation to each other, driven by 
real-time telemetry from the ISS, to 
provide in situ awareness for the flight 
controllers who are flying the arm. 

Crew, Houston, and Canadian 
Ground Control Working Together— 
A Case Study 

Another key capability of the arm 
is to capture visiting vehicles (see 
also Chapter 14)—a process that is 
performed symbiotically between the 
ground and crew, as illustrated by 
the example of the fifth H-II Transfer 
Vehicle (HTV) cargo mission to the 
ISS. On August 15, 2015, the Japan 
Aerospace Exploration Agency 
launched the HTV5 “Kounotori 5” 
resupply vehicle toward the ISS. 


Prior to the launch, flight controllers 
in Houston and Montreal attached 
the SSRMS to a PDGF on Node 2 
and positioned it for the arrival of the 
visiting vehicle. After a couple days of 
free flight, HTV5 arrived underneath 
the space station and started slowly 
approaching the ISS on August 24 
(Figure 14). 

Over the course of a couple of hours, 
HTV5 moved closer to the ISS, 
orbiting just below the station (see 
“Are we there yet?” in Chapter 14). 

As the HTV moved closer, the crew 
on board the space station monitored 
the vehicle to verify it stayed within 
the approach corridor. The trajectory 
is designed such that HTV arrives at 
its station while keeping the position 
with its grapple fixture directly in 
front of the SSRMS FEE (Figure 15). 

From that point, the on-board crew 
members take over. They maneuver 
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Figure 15. Flight Director Royce Renfrew and his team watch as the HTV5 arrives at the capture point, oriented such that its grapple fixture is directly in 
front of the LEE. The gold-colored material (left in the view) is part of the thermal covering of the vehicle. The white circle in the center of the gold-colored 
area is the grapple fixture. JAXA astronaut Koichi Wakata is sitting to the right of the Flight Director. 


the arm to grapple the free-flying 
HTV5. Crews train extensively to 
be able to capture a vehicle that is 
not completely steady. The amount 
of hand/eye coordination and quick 
responses required to grapple a free 
flyer precludes the flight controllers in 
Houston or Montreal from being able 
to capture a vehicle. Once the HTV5 
was captured, however, operations 
transitioned back to the ground. The 
ROBO took over the operations and 
maneuvered HTV5 to mate with 
the Node 2 nadir-facing Common 
Berthing Mechanism. Working in 
concert with the on-board crew 
members who operate the common 
berthing mechanism, the ground 
team installed the HTV5 on the 
Node 2 nadir port (Figure 16). See 
also Chapter 3. 



Figure 16. The HTV5 being maneuvered toward the Node 2 nadir Common Berthing Mechanism on 
the ISS (top of image). 


SYSTEMS: ROBOTICS-THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 


261 






















Several days after arrival, the 
SSRMS removed the exposed 
pallet from the HTV trunk. The 
pallet contained a new payload for 
the Japanese Experiment Module 
exposed facility. Additionally, two 
completed and used-up experiments 
were placed on the exposed pallet, 
which was eventually installed back 
in HTV5 for disposal (Figure 17). 
Reversing the capture and berthing 
process, the crew and ground 
removed the HTV from the ISS 
on September 28. The HTV then 
reentered the Earth’s atmosphere 
and disintegrated. 

Operational Challenges 
and Triumphs 

The SSRMS was delivered to the 
ISS in 2001 during the STS-100/ 
ISS-6A assembly mission. Its 
activation and commissioning did 
not go smoothly, however. Not long 
after the arm had been activated, the 
ISS Primary Command and Control 
(C&C) Multiplexer/DeMultiplexer 
(MDM) (see Chapter 5) failed. 

This by itself was not critical. 
Computers are known to have 
problems now and then, which is 
why there are three of these on the 
ISS. However, by all indications, it 
was not a software problem; rather, 
the spinning hard drive had failed. 
The robotic systems relied heavily 
on the hard drive, reading critical 
programming files and recording key 
data about the system performance 
for flight controllers to monitor. 

Due to this reliance and use of the 
hard drive, it was first believed that 
the SSRMS was the cause of the 
failure. This concern increased when 
a second C&C MDM failed with 
a similar signature. The situation 
became more critical when the third 



Figure 17. Astronaut Kjell Lindgren operates the 
Canadarm2 to install the exposed pallet into the 
HJV5 trunk area. The exposed pallet contained 
two experiments that had been completed and 
were ready for disposal. NASA video. 

computer failed (see also “When 
Computers Crash,” Chapter 5). As 
the Onboard Data Interfaces and 
Network (ODIN) (see Introduction) 
flight control team figured out how to 
recover the computers, the robotics 
flight controllers were challenged to 
complete the operations on ISS-6A. 
These operations included returning 
the pallet on which the arm had 
been delivered back to the shuttle 
payload bay, and putting the arm in 
a safe configuration for the shuttle 
undocking. Fortunately, the arm was 
already activated when the MDMs 
failed because, normally, it loads 
all of its operating software from 
the same hard drives that failed. 
However, the crew’s displays on 
the Portable Computer System, 
which is used for operating the 
SSRMS, also depend on the hard 
drive. ROBO was faced with a 
brand new robotic arm with no way 
to control it. Ground control had 
not yet been invented. The ground 
team worked rapidly to figure out 
how to have the crew maneuver the 
SSRMS to the needed position, and 
then have the astronauts fly the last 
little bit using the hand controllers, 
which still worked. This had to be 


accomplished without the displays 
that the crew had been trained to 
use, and had to be executed under 
the direction of ROBO using video 
and telemetry on the ground. In this 
fashion, the team “limped” through 
the remaining robotics operations. 
After the mission, the ROBO team 
began working out concrete plans for 
ground control operations. 

After detailed investigation by 
the flight control and engineering 
teams over several weeks, the 
flight control team determined that 
various problems during years of 
testing on the ground had caused the 
C&C MDM hard drives to literally 
fracture. Although this had significant 
implications for the space station 
since these computers controlled the 
US On-orbit Segment, it directly 
and severely impacted the robotic 
operations. The next mission, 
STS-STS-104/ISS-7A, was scheduled 
to deliver the airlock module; the 
SSRMS was required to successfully 
install it, as was the case with all 
remaining modules. Flight controllers 
worked hard over the next 3 months 
to install spare hard drives and 
reload all the software from scratch, 
including the robotics software. No 
further problems occurred during the 
installation of the airlock on ISS-7A. 

New challenges soon emerged. 

On March 5, 2002, one of the two 
redundant electrical drive motors on 
the wrist roll joint on the “A” end 
(see Figure 4) failed on the SSRMS. 
Two systems were built into the arm 
so that if one failed during a critical 
operation, such as while installing 
a module, the second motor could 
take over and complete the job. 
However, to start a major operation 
with one system already failed 
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Figure 18. Mission Specialists Franklin Chang- 
Diaz (red stripes on legs) and Philippe Perrin 
repair the wrist roll joint on STS-111/ISS-UF-2 
on June 11,2002. (Top) Crew members set up 
to perform the replacement. The shuttle robotic 
arm (Canadarm), in the left of the image, acts as 
a “cherry picker” to move one of the astronauts 
around. An articulating portable foot restraint near 
the feet of the other astronaut acts as a fixed boot 
plate during the repair. (Middle) After installing 
the portable foot restraint in the shuttle robotic 
arm, Chang-Diaz inserts his feet in the boot plate. 
Astronauts inside the shuttle maneuvered him to a 
location where he could remove the station robotic 
arm’s LEE. The LEE had to be removed to get to 
the failed roll joint, which is the next joint in line. 
(Bottom) The new roll joint, installed on the station 
robotic arm. Note how the multilayer insulation 
(MU) on the new joint is much whiter in color than 
the MU on the other station arm components. 
Off-gassing of the MU changes its color over time 
on orbit. Both crew members in this picture are 
maneuvering the old LEE to reinstall it. 

meant another failure could leave 
the arm stuck. A module stranded 
on the end of the SSRMS would be 
an extremely critical scenario. First, 
critical cables that provide power to 
heaters that keep the equipment from 
freezing have to be disconnected 
from the shuttle payload bay and 
reconnected after the module is 
berthed. Hardware stuck on the arm 
could freeze in a matter of hours. 
Second, this configuration would not 
be stable enough for the space shuttle 
to undock because vibrations and 
thruster plumes from the shuttle could 
jolt the SSRMS during the undocking 
process. This could damage the arm 
and even cause the hardware to be 
inadvertently released, possibly 
colliding with the ISS. 

Since there was no way to replace 
only a motor on the arm, the entire 
joint containing the two drive 
motors would need to be replaced. 
Unfortunately, the spare joint 
motor could not be delivered and 



SYSTEMS: ROBOTICS-THE CONSTRUCTION EQUIPMENT FOR THE INTERNATIONAL SPACE STATION CHAPTER 15 


263 























installed until STS-111/ISS-UF2, 
after the STS-110/ISS-8A mission, 
which required the arm to install 
a key component of the ISS truss. 

The flight control team quickly put 
together a plan that would not require 
using that particular joint. The 
ROBO team developed a less-direct, 
complex sequence of maneuvers, 
enabled by the number of joints 
and the wide range of position each 
possessed. Although the primary 
system was working fine, the plan 
could not use that joint since a failure 
could put the arm in a position from 
which it could not be safely moved. 
However, it was never envisioned 
that the controllers would operate 
the software in this way, instead 
trying to figure out where the arm 
needed to go and calculating the 
most efficient way to get there. The 
ROBO team conceptualized the new 
software operations and the code was 
updated and tested quickly by CSA 
contractor MacDonald Dettwiler and 
Associates. Procedures were updated 
and the crew quickly retrained on the 
new operational scheme, which was 
now referred to as Degraded Joint 
OPerationS (DJOPS). This entire 
process was performed in about 
1 month and the ISS-8A mission was 
completed without incident. As with 
all situations, the flight director and 
flight control team spent a lot of time 
preparing for the worst and hoping 
for the best. Although the DJOPS 
was not used on that mission, it has 
become a standard capability. 


During STS-1 ll/ISS-UF-2, similar 
contingencies were prepared for 
the flight’s robotics mission design, 
which involved the installation 
and deployment of the MBS, as 
well as spacewalk support. The 
SSRMS joint was successfully 
replaced (Figure 18) during the final 
spacewalk of the mission, taking 
place exactly 100 days after the joint 
failure first occurred. The new joint 
restored SSRMS fault tolerance, and 
the ISS assembly could continue 
on the subsequent shuttle missions 
with a fully functional arm. 


Conclusion 

As with the construction of any 
project, whether it be a pyramid 
or a space station, tools are very 
important. The ISS robotic systems 
were critical for the successful 
assembly of the station. Based on the 
experience of the SSRMS, the space 
station robotic systems are both more 
complex, as well as significantly 
more capable and flexible. Although 
the ISS and its construction was 
developed with the MSS in mind, 
the SSRMS and its family of 
support equipment has been critical 
in supporting the daily operation 
of the station, often used in ways 
never originally imagined. External 
hardware, such as Remote Power 
Control Modules, are now routinely 
replaced using the SPDM, thus 
allowing the astronauts to focus on 
more scientific research. As discussed 


in Chapters 17 and 18, the big arm 
was critical in numerous spacewalks, 
including spectacular contingency 
operations, and will continue to play 
a major role in the operation of the 
ISS. Robotic systems in science 
fiction movies tend to inspire awe 
by moving fast and operating with 
significant, often autonomous, 
intelligence. Reality is that the MSS 
on the ISS represents the state of the 
art today as it inspires awe in the 
robust and flexible manner that it 
supports an outpost on the edge of 
space. At the core of the system is the 
seamlessly blended NASA and CSA 
flight control team on the ground. 
Through discipline and competence, 
the ROBO team has pushed this tool 
to its maximum potential. Some 
form of robotics will be needed 
for humans venturing to the moon, 
Mars, and beyond. Operations in 
the harsh environment of space are 
best performed by robotics, leaving 
the human explorers safer in the 
relative protection of their spacecraft. 
The lessons learned after years of 
operating the space station robotic 
system will play a vital role in 
development and operations of those 
future robotic systems. 
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Chapter 16 Day in the Life: 

In-Flight 

Maintenance 




Expedition 43 astronauts Scott Kelly (left) and Terry 1 Ms perform in-flight maintenance on the Carbon Dioxide Removal Assembly The inner workings of the 
device were removed from the rack in Node 3 and moved to the Japanese Experiment Module to provide a larger area in which the crew can work. 


A spacecraft as large, complex, 
and long-lived as the International 
Space Station (ISS) will clearly need 
to be maintained f . This is especially 
true when considering that the first 
components of the ISS have been in 
space since 1998. ISS maintenance 


is the responsibility of both the crew 
and the flight control teams as part 
of day-to-day operations. Some 
components have limited lifetimes 
and need to be replaced or repaired 
on a periodic basis. Examples of 
equipment in this category include 


dust filters, batteries, experiment 
igniter tips, overhead lights, 
and various waste filters in the 
regenerative life support system. 

Other components need regular 
inspection to ensure they are 
still functioning, or are able to 
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function properly. Examples of 
such components include hatches, 
portable breathing masks, and other 
emergency equipment. 

Finally, hardware may simply break 
unexpectedly and will need to be 
fixed for a certain component or 
system to be returned to operational 
use. When hardware fails on the space 
station, the way it fails or breaks may 
not have been envisioned when the 
hardware was being designed. 

All of this work falls in the realm 
of in-flight maintenance (IFM). 

IFM occurs both inside and outside 
of the ISS. The primary focus of 
this chapter is the internal IFM, 
which is managed by the Operations 
Support Officer (OSO) console. 
External maintenance, which might 
include replacing a cooling pump or 
installing power cables, is managed 
by the extravehicular activity (EVA) 
console and is discussed in detail in 
Chapters 17 and 18. 

The three categories of IFM 
include: Preventive Maintenance, 
Corrective Maintenance, and 
Diagnostic Maintenance. Preventive 
Maintenance entails all of the regular 
cleanings and inspections that are 
performed to ensure the proper 
operation of the hardware or system. 
Corrective Maintenance involves 
repairing or replacing hardware that 
has stopped working either because 
it is a consumable at the end of its 
life (e.g., a filter) or because it has 
broken unexpectedly (e.g., a light 
bulb or computer). Sometimes, 
hardware or equipment breaks and 
it is not obvious what has broken, 
especially in electronic equipment. 

In these cases, Diagnostic 
Maintenance is first required to 


determine where faults might be 
located, and to help ground teams 
establish the best way to repair the 
hardware or situation. 


Maintenance Methodology 

To the maximum extent possible, 
all ISS maintenance procedures are 
thoroughly reviewed and validated 
on mock-ups or flight-like hardware 
before the crew performs any 
procedures. OSO flight controllers, 
assisted by the necessary engineering 
specialists, develop methods and 
procedures for all maintenance tasks 
inside the ISS—from accessing and 
cleaning a filter, to the complicated 
replacement of a valve in the 
Carbon Dioxide Removal Assembly. 
Whenever possible, these procedures 
are tested on the ground prior to 
being given to the crew to ensure 
the correct tools are called out and 
that no unexpected problems occur 
while accessing certain areas, and 
to look for any hidden “gotchas” 
throughout the maintenance activity. 
Such procedures “walk” the ground 
teams and the crew through every 
aspect of maintenance activities. 

The general flow of these procedures 
is to gather the needed tools and 
spare parts, turn off the power to the 
equipment, access the equipment 
being maintained, perform the 
maintenance, clean up and close 
out the workspace, and finally turn 
everything back on and ensure the 
hardware is functioning properly. 

Some aspects of ISS maintenance 
are similar to the maintenance 
done at home, or in automotive or 
aircraft repair facilities. Crews use 
standard hand tools to remove bolts 
and other fasteners to access broken 


components. They remove failed 
components and replace them with 
spare parts, then put the equipment 
back together using a torque wrench 
to ensure every fastener is tightened 
properly. In some instances, a good 
pair of pliers will help move a 
stubborn panel or a bent fastener. 
Given that astronauts all have 
varying degrees of experience in 
tools and maintenance, each crew 
member participates in maintenance 
training lessons that range from tool 
identification to performing complex 
maintenance operations on jet 
aircraft hardware. They also receive 
instruction on soldering, sewing, 
using a rivet gun, replacing Ethernet 
connectors, and creating wire jumpers 
and splices, not to mention the use of 
items such as a tap and die kit, driver 
drills and impact drills, and screw 
extraction kits. 

The ISS is stocked with a wide 
variety of spare parts and tools 
because resupply from Earth is 
difficult, expensive, and time 
consuming. The tool inventory on 
board includes an array of hand 
tools, repair kits, and a number of 
specialty tools such as multimeters, 
pressure and temperature monitors, 
oscilloscopes, borescopes, and 
fiber optic diagnostic systems. 

Table 1 provides a summary of the 
maintenance tools and kits available 
for use in the US Segment of the ISS. 

Maintenance and system upgrades 
on Earth often generate stories 
worth retelling, both when things 
go right and when things do not go 
quite as anticipated. What follows 
are a few of these stories to describe 
the implementation of some of 
the different types of maintenance 
performed on the space station. 
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Table 1. Summary of ISS Tools and Diagnostic Equipment for use in the Pressurized ISS Environment 


In-Flight 

Maintenance Tools 

Description 

ISS Toolbox 

(Figure 1) 

A box of five sliding drawers that stores a majority of the ISS 
hand tools. The toolbox contains various sizes of wrenches, 
sockets, ratchets, torque wrenches, screwdrivers, pliers, 
L-wrenches, hammers, pry bars, files, tape measures, saws, 
feeler gauges, chisels, and punches. Many tools are available in 
both metric and standard sizes. 

Multiple sets of the commonly used tools are kept on the ISS to 
provide spares and to allow more than one crew member to use 
the same size/type of tool at the same time. 

Power Tools 

The handheld, battery-operated power tools on the ISS include 
driver drills, impact drivers, and the necessary drill bits, 
batteries, and chargers. 

Repair Kits 

The repair kits on the ISS include a generic parts kit that 
contains hose clamps, hose menders, hex nuts, zip ties, 
fasteners, countersunk screws, solid-state relays, switches, 
breadboards, potentiometers, capacitors, resistors, light- 
emitting diodes, transistors, diodes, circuit board fuses, 
cartridge fuses, knobs, tape, and foam. 

Additional repair kits include an Ethernet kit, soldering kit, 
wireway and coldplate covers, clamp and bracket kit with rivet 
gun, light-duty and heavy-duty sewing kits, screw extractor kit, 
and tap and die kit. 

Electrical Tools 

For electrical repairs, the ISS has a Scopemeter, which is a 
combination multimeter and oscilloscope, a current probe, 
a temperature probe, a pressure probe, a multimeter, and 
oscilloscopes. 

Two pin kits contain a number of wires of various gauges as well 
as pins and sockets to enable crew members to create their 
own jumper wires. These kits also have the various plugs and 
adapters needed for use with the Scopemeter and multimeter to 
take measurements on the ISS wiring. 

Diagnostic 

Equipment 

Fortroubleshooting and investigating maintenance problems, 
the ISS has diagnostic measurement software, a diagnostic 
power supply and accessories, a databus analyzer kit, 

Breakout Box, Multiplexer/DeMultiplexer On-Orbit Tester, 
electrical cable tester, fiber optic diagnostic and cleaning kits, 
and a fiberscope kit. 

Fluid Servicing 

(Figure 2) 

A Fluid System Servicer is used to drain and fill fluid lines inside 
the ISS. A fluid fitting torque device is used to mate and demate 
gamah-type fluid connections, which require very high torque 
to fully seal them. Fluid sampling tools are used to take and test 
fluid samples in the various internal thermal control loops. 

Leak and Fire 

Maintenance equipment will be needed in the cleanup after 
an overboard leak or a fire on the ISS. Kits to support that 
work include the ISS Leak Kit and the Post-Fire Cleanup Kit. 

The ISS Leak Kit contains patches for sealing small holes to 
vacuum in the pressure shell as well as the Ultrasonic Leak 
Detector to help the crew find the leak point. The Post-Fire 
Cleanup Kit includes the tools and adapters needed to clean 
combustion by-products out of the cabin air after a fire has 
been extinguished. 



Figure 1. The ISS toolbox in Node 1. 



Figure 2. Shannon Walker with the 
Fluid System Servicer. 
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“Can You See It Now?” 

The Finding Ready to Latch section 
of the Structures and Mechanisms 
chapter provides details on the 
Centerline Berthing Camera System 
(CBCS). The heart of the CBCS is 
a video camera that looks through a 
hatch window at an incoming space 
station module or cargo vehicle. The 
camera view is important in ensuring 
precise alignment of the new module 
before it can be attached to the ISS. 
On Space Transportation System 
(STS)-102/ISS-5A. 1 (2000), the 
CBCS video signal was to be sent 
to the aft flight deck of the orbiter to 
assist the shuttle crew in installing 
the Multi-Purpose Logistics Module 
(MPLM) for the first time. This 
would also be the first time the CBCS 
signal was sent from Node 1 through 
the newly installed US Laboratory, 
through Pressurized Mating Adapter 
(PMA)2, to a visiting orbiter (Space 
Shuttle Discovery, in this case). 

The video monitor on the aft 
flight deck remained black after 
everything was connected and 
power was applied to the camera 
for a checkout on the day prior to 
MPLM installation. Thankfully, the 
CBCS checkout had been scheduled 
to occur the day prior to the MPLM 
installation, which gave the ground 
teams time to troubleshoot overnight. 
By the following morning, the 
crew had a fresh set of Diagnostic 
Maintenance procedures that could 
be used to pinpoint the source of 
the problem. 

The crew first used one of the ISS 
laptops as a portable video monitor. 
With some spare cabling, the crew 
connected the laptop to the CBCS 
camera. This setup enabled crew 


members to see the video and 
confirm the camera was functioning 
properly. For the CBCS to be fully 
operational, the camera needed to 
receive a return (sync) video signal 
from the orbiter. Yet, when the crew 
connected the laptop to the return 
line from the orbiter, no video was 
displayed, thereby indicating a video 
cable problem between Node 1 and 
the orbiter. 

After ruling out any problem with 
the CBCS, the ground team looked 
at ISS video system drawings. It 
turned out that although PMA3 
(used successfully with CBCS on 
STS-98/ISS-5A, months earlier) 
and PMA2 are nearly identical, the 
video wiring is not. The video and 
sync lines were inadvertently crossed 
on the PMA2 drawings. This cross 
wiring was dutifully implemented 
according to the drawings when 
PMA2 was built. This problem was 
not caught in ground testing because 
the testing did not use a setup that 
requires successful receipt of the 
video signal on the sync line, which 
is something the CBCS requires. 

Once the problem was identified, 
developing a solution was simple. 
The video lines between Node 1 
and the orbiter needed to be 
“uncrossed.” The crew created two 
jumper wires using the on-board pin 
kit, which is a collection of spare 
wire and electrical contacts (pins 
and sockets). These jumpers allowed 
the crew to cross the video and sync 
lines in the US Laboratory so that the 
wiring for the PMA2 would uncross 
it. This option was possible because 
the ISS wire bundles and harnesses 
have numerous connectors located 
throughout the spacecraft that are 
readily accessible to the crew. When 


necessary, the crew can disconnect 
a wire bundle and use a connector to 
perform diagnostic troubleshooting 
on hardware or, in the case of the 
CBCS, correct an error in design 
and manufacturing. 

The result: Successful CBCS video 
was received on the flight deck in 
time to complete the first installation 
of an MPLM on the ISS. A more 
permanent jumper was manufactured 
and flown on STS-100/ISS-6A a few 
months later, and installed in place 
of the temporary pin kit jumpers. 

That jumper harness remained 
installed until Node 2 (Harmony) 
was installed on STS-120/ISS-10A 
(2007). Node 2 was built with 
crossed video wiring such that it 
would correct the wiring problem 
in PMA2 without the need for the 
extra jumper in the US Laboratory. 

“Where’s The Leak?” 

Air leaks on a spacecraft are usually 
bad news because the air needs to 
stay inside for the crew to breathe. 
However, when an EVA (i.e., 
spacewalk) takes place, the airlock 
must be able to be depressurized 
to vacuum. When the normally 
pressurized airlock and its systems 
are at vacuum, there must also be 
certainty that no cabin air from 
elsewhere on the ISS leaks into the 
depressurized airlock. In the early 
years of the ISS, both types of “things 
you don’t want” occurred; i.e., a 
small leak of cabin air to space, and a 
small leak of cabin air into the airlock 
when it was at a lower pressure than 
the rest of the space station. In both 
cases, a diagnostic tool was required 
to help the crew find the source of the 
leak and stop it. 
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Figure 3. Expedition 8 Commander Mike Foale uses the Ultrasonic Leak Detector to try to pinpoint 
a small cabin leak to space near the window in the US Laboratory. A small probe is attached to the 
microphone of the ULD (near the astronaut’s hand), which detects the ultrasonic noise of leaking air. 
That ultrasonic noise is converted to audible noise that the astronaut listens to in the headphones. 
The louder the noise, the closer the ULD probe is pointed toward the leak point. 


The new Joint Airlock, named 
Quest, was brought to the ISS on 
board STS-104/ISS-7A (2001). This 
proved to be an ambitious assembly 
mission. The first two of three EVAs 
to install the new ISS airlock were 
successfully conducted from the 
airlock of the Space Shuttle orbiter. 
The mission called for the final EVA 
to be conducted from the new airlock 
to prove that all airlock systems 
functioned correctly. A feature of the 
airlock design is that a depress pump 
can pump cabin air from the airlock 
back into Node 1. Instead of having 
to vent the cabin air overboard when 
depressurizing the airlock, and thus 
losing the valuable air resource, the 
air can be saved by putting it back in 
the ISS stack. This would only work 
as long as the hatch seal between 
Node 1 and the airlock did not leak. 

It also meant that the seals in the air 
lines between the depress pump and 
Node 1 could not leak; otherwise, 
cabin air would leak back from 
Node 1 into the airlock. 

It was quickly discovered that a 
leak existed in the air lines when the 
depress pump was first turned on, 
thus allowing air from Node 1 to 
leak back into the airlock. This leak 
prevented crew members from being 
able to keep the airlock at the lower 
pressure they needed. Fortunately, a 
new diagnostic tool—an Ultrasonic 
Leak Detector (ULD)—was flown 
to the ISS on this mission. The ULD 
is a tool used widely in industry 
to find leaks in pressure vessels 
by converting the ultrasonic noise 
created by the leaking, turbulent gas 
into an audible sound. The more 
directly the microphone of the tool is 
pointed at the leak point, the louder 


the sound gets. The crew successfully 
used the ULD during the mission to 
locate a leaking fitting on the depress 
pump. The fitting was tightened 
and, ultimately, the final EVA of the 
mission was completed from the 
brand new airlock. 

The primary reason for sending the 
ULD to the space station was to 
help the crew find leaks of cabin 
air to space. This method of using 
the ULD was first put to the test 
during Expedition 8 (2004). The 
ground teams detected a small leak 
(approximately 1.2 mm Hg 
[0.02 psi] pressure drop per day); 
however, the point of the leak could 
not be easily determined. The leak 
rate was slow enough that crew 
members did not need to perform 


their emergency depressurization 
procedures; nonetheless, they did 
need to determine the source of the 
leak in order to stop it and prevent 
additional air from escaping. Over 
a number of weeks, the crew and 
the ground used the ULD and other 
techniques to isolate the leak to 
somewhere in the US Laboratory. 
The crew then used the ULD to 
survey the laboratory. The crew 
ultimately determined that the 
loudest source of ultrasonic noise 
was coming from a vacuum hose 
attached to the large window in that 
module (see Figure 21 in Chapter 3). 
The crew demated the hose from 
the vacuum source, which stopped 
the air from leaking. 
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“That’ll Never Happen” 


The computer systems on the ISS are 
divided into tiers (see Chapter 5). The 
Command and Control Multiplexer/ 
DeMultiplexers (MDMs) make 
up the topmost tier. The three 
Command and Control computers, 
for redundancy, are always 
powered on. One is designated as 
the primary computer; the other 
two serve as backups. Prior to the 
STS-100/ISS-6A (2001) mission 
it was considered impossible— 
or, at least, non-credible—for all 
three of these computers to fail 
at the same time. If this were to 
happen, there would be nearly no 
way for the crew or the ground 
to interface with any of the other 
computers or space station systems. 

During STS-100/ISS-6A, the 
impossible happened. One after 
another, all three computers failed. 
Fortuitously, this failure occurred 
while the Space Shuttle orbiter was 
docked. Since the orbiter had its own 
communication link with the ground, 
instructions could be voiced up to 
the ISS and orbiter crews to assist 
in recovering the computers. After 
some troubleshooting, the ground 
team determined that the only way 
to recover the system was to build 
new computers. The Payload MDMs 
are physically the same size as the 
Command and Control MDMs and 
use most of the same computer cards. 
Thus, one of the Payload MDMs 
was deemed a suitable Orbital 
Replacement Unit (ORU) to scavenge 
in order to build a new Command 
and Control MDM. Since the MDMs 
were not identical and did not have 
the same software load, the crew 



Figure 4. The front cover of two MDMs are removed while the crew works to repair them during the 
STS-100/ISS-6A mission. The computer on the left is a Command and Control MDM, evidenced by the 
large black box of a hard drive in the right-hand bay of the MDM. The MDM on the right does not have 
the hard drive installed. 


performed corrective maintenance 
to remove a Payload MDM, change 
some cards inside, and repurpose it as 
a Command and Control MDM. 

The MDMs on the ISS were 
designed to be maintained at two 
different levels. The entire MDM 
ORU could be replaced. Or, the front 
face plate of the MDM could be 
removed, and individual computer 
cards or hard drives inside the 
MDM could be changed. A 
combination of both ORU-level 
and card-level maintenance was 
required to create the new Command 
and Control MDMs. 

First, the backup Payload MDM, 
which is usually not powered when 
the primary Payload MDM is 
functional, was removed from its 
rack location in the US Laboratory. 
The front plate of that MDM was 
opened. Spare computer cards were 
inserted to change the internal 
card configuration to match the 
configuration of the Command and 
Control MDM. One of the spare 
cards was a hard drive that included 
the software needed for the MDM to 


boot up. Once this new Command 
and Control MDM was installed, the 
ground was able to boot the newly 
constructed MDM into a diagnostic 
mode, which is similar to safe 
mode on a home personal computer. 
In this state, the ground slowly 
erased the payload operating software 
and loaded the data for the Command 
and Control software. Once all 
files of the new operating system 
were loaded, the flight controllers 
rebooted the machine and slowly 
recovered all the necessary software 
functions. With a single Command 
and Control MDM running, the crew 
completed additional IFM work to 
repair the other two Command and 
Control MDMs. 

“Give It a Whack” 

For space station hardware to be 
strong and secure enough to survive 
the fairly rough ride into space and, 
at the same time, fit together well, 
designs usually require precise 
manufacturing and allow only 
small tolerances in the fit between 
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components. Ideally, everything 
would be fit checked on the ground 
prior to launch; however, this not 
always possible due to schedule, 
cost limitations, and the fact that 
many of the hardware pieces are 
built in different countries around 
the world. In addition to the standard 
conditions of their intended use, flight 
hardware must endure the vibrations 
of launch, the change in pressure as 
hardware goes from Earth pressure to 
vacuum (for hardware kept outside 
on the ISS), and the widely changing 
thermal environment in Earth orbit. 
The thermal environment especially 
affects hardware located outside the 
space station, as that environment 
fluctuates with each orbit as well as 
with each season. 

Despite the best maintenance 
approaches and planning, as well 
as the best hardware design, two 
pieces of hardware can get stuck 
together and need to be separated. As 
sometimes happens when conducting 
repair work on Earth, the two pieces 
may need nothing more than a slight 
tap or even a good whack. Due to the 
cost of equipment on the ISS, this is 
usually an option of last resort. 

The need for a tap or a whack has 
played out a number of times on the 
ISS. On multiple occasions, hardware 
inside the space station needed some 
extra hammer taps to be convinced to 
come free from mounting locations 
they had occupied since launch. The 
same is true for hardware outside 
the space station. During an EVA in 
Expedition 6 (2003), astronauts Ken 
Bowersox and Don Pettit needed 
to move a light stanchion, or post, 
that was mounted to the ISS truss. 

The stanchion was held in place by 
a single bolt, and it sat in a type of 


tongue-and-groove interface on the 
truss. After the bolt was released, 
the stanchion refused to come free 
from the truss. After the astronauts 
tried multiple ways of wiggling and 
shaking to free the stanchion, it was 
decided to abandon the stanchion 
until the next EVA so that the ground 
team could come up with additional 
options and recommendations. 

After much discussion between the 
engineering and flight control teams 
on the ground, it was decided that 
the best option for the second EVA, 
if renewed wiggling and shaking did 
not work, was to use a hammer to 
tap the stanchion free. After a few 
small taps did not free the stanchion, 
the crew gave the stanchion a 
more reasonable “whack,” and the 
stanchion came loose. 

The STS-114/ISS-LF1 (2005) 
mission was the Return to Flight for 
the Space Shuttle Program after the 
loss of the Space Shuttle Columbia. 
This mission brought the MPLM to 
the space station to provide some 
much needed cargo resupply. The 
MPLM is a full-sized ISS module, 
flown up in the Space Shuttle cargo 
bay, and attached to one of the ISS 
Node modules. Once the MPLM was 
attached on this mission, the crew 
was ready to open its hatch and start 
transferring supplies. 

As happens with most new modules 
that are brought to the ISS, once 
power is available to the module, 
the internal fans are turned on to 
circulate the air within the module 
before the hatch is open. This draws 
any free-floating debris to the air 
filters so the crew members do not 
breathe in the debris or get any 
in their eyes when they enter the 


module for the first time. This air 
motion can generate a slight increase 
in pressure inside the module, 
which will effectively push the 
hatch closed. Given the large size of 
the hatches, even a small pressure 
differential across a hatch can create 
a large pressure force pushing the 
hatch against its seals, which would 
prevent the crew from being able 
to open the hatch. For example, a 
pressure differential of 0.98 mm Hg 
(0.019 psi) pushing the hatch closed 
will require the crew to put 220 N 
(50 lb) of force into the hatch handle 
to overcome the pressure. When the 
external side of a hatch is exposed 
to space vacuum, approximately 
173,500 N (39,000 lb) of force press 
the hatch against the bulkhead seals. 

Hatch designers thought of this, 
of course, when the hatches were 
designed. All hatches have valves that 
crews open to allow the pressure on 
both sides of the hatch to equalize. 
Thus, to open any hatch on the space 
station, the crew must first open the 
equalization valve and wait for the 
pressures to balance. 

On STS-114/ISS-LF1, crew members 
opened the equalization valve and 
waited the appropriate amount of time 
to equalize the MPLM pressure with 
the ISS pressure. When they tried to 
open the hatch, it would not budge. 

As described in the “Hatches” section 
of Chapter 3, the hatch mechanism 
contains “kickers” that push against 
the bulkhead of the module when the 
crew turns the hatch handle. These 
kickers help crew members unseat the 
hatch. Even though crew members 
put extra force into the hatch handle 
to try to get these kickers to push 
harder against the bulkhead, the hatch 
would not open. 
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When The Nearest Handyman is You 

Colonel Timothy Kopra, Expeditions 20 and 46/47 


The ISS is a world-class orbiting laboratory. Every 
day, the crew members on board conduct a variety 
of experiments that will help us prepare for going out 
beyond Earth’s orbit, discovering fundamental aspects 
of science, and improving life on Earth. The space 
station is an amazing place to work and live, but the 
environment we have is only what we have created and 
maintained. Outside of the station’s thin aluminum hull 
is a vacuum that is completely inhospitable to life. It is 
so vital, then, that we maintain and sometimes repair the 
systems on board that provide our clean atmosphere, 
water, electricity, thermal control, and communications, 
just to name a few. 

One of the key components of our life support system 
on the space station is the Carbon Dioxide Removal 
Assembly (ODRA). After we extract the oxygen that our 
body needs when we inhale, we exhale a significant 
amount of carbon dioxide (C0 2 ). Each person exhales 
around 20 liters (5 gallons) per hour, for a total of 120 liters 
(32 gallons) per hour introduced into our atmosphere 
when there is a crew of six on board. Humans are very 
sensitive to even low amounts of C0 2 when we breathe it 
in. Just a fraction of 1 % of C0 2 in the air can give you a 
headache, cause fatigue, and affect how clearly you think. 

The primary ODRA installed in Node 3 failed in 
February 2016, when the fan motor controller 
malfunctioned. This device controls the operation of 
the blower that provides airflow through the ODRA. 

The task of replacing the motor controller was a bit like 
removing the engine from a small car and then replacing 
some of the components attached to it. The ODRA was 
located in a rack about the size of a large refrigerator 
behind some panels. It is tightly installed within the 
rack and connected to other parts of the system. 

After removing the panels to get access to the CDRA, 
Scott Kelly and I followed the well-crafted procedures 
developed by the ground maintenance team to slide the 
CDRA out, disconnect it, and remove it from the rack. 
After this, we were able to get to work on the repair. 


We floated the large CDRA through the station to a 
maintenance work area (our workbench), located in 
Node 2. While zero gravity makes it easy to move around 
a large piece of hardware such as the CDRA, it can be a 
bit tricky to secure it and set it up for maintenance. We 
used a set of bungee cords on the maintenance work 
area to keep the CDRA in place while still providing 
access for the maintenance tasks. 

Since considerable time is dedicated to removing a 
CDRA, the ground team decided that we should also 
replace some other parts that were not in top working 
order. We were tasked with replacing a heater controller 
and one of CDRA’s valves as well as the motor controller. 
Earlier in the morning, we had collected the spare 
components and all of the tools that we needed for 
removing and replacing each part. The rest of the job was 
pretty straightforward: Scott and I worked together to 
replace the failed components using the procedures that 
described in detail which tools to use and the steps to 
remove the components and install the new ones. After 
the removal and replacements were complete, we worked 
in reverse, floating the CDRA back to Node 3, installing it 
back into the rack, and reattaching the panels. We then 
waited with anticipation as the ground team performed 
the activation steps to make sure it all worked. We were 
glad to hear the call from Mission Control that the Node 3 
CDRA was again up and running. 

One lesson that this relatively routine maintenance 
task highlights for me is how important it has been for 
us to have a highly functioning team to keep the ISS 
operational every day. Teams of experts on the ground 
have the in-depth knowledge of all of the systems and 
hardware on board, and they are the ones who identify 
the failures that occur, develop the thorough and clear 
procedures, train us to make the repairs, and manifest the 
replacement parts and tools for maintenance. We have 
a team of teams that keep our space station flying, and 
they frankly do such an outstanding job that they make it 
look easy. And it certainly is not. 
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Figure 5. Expedition 11 Commander Sergei Krikalev and STS-114/ISS-LF1 Mission Specialist Wendy 
Lawrence prepare for opening the MPLM hatch in 2005. Their initial attempts would not be successful. 
Ultimately, a well-positioned shove would be required to open the hatch. 


Ground controllers in Houston 
struggled to come up with another 
option as all the standard “tricks” 
were not working. With everything 
the crew and ground had tried, the 
hatch should have opened easily at 
this point. The ground teams talked 
about the possibility that the MPLM 
hatch may not open at all, and what 
the impacts to the mission might be 
in that scenario. As Mission Control 
talked to the crew about possible 
options, the flight control team 
heard a muffled “ooomph ” in the 
background, followed by a cheer from 
the crew. The hatch had opened. The 
trick that worked? One of the taller 
astronauts stood on the hatch ribs and 
then crouched while reaching up to an 
overhead footbridge. He straightened 
his body and pushed hard against the 
Node 1 footbridge. Effectively, he 
put all his weight into the hatch and 
forced the hatch open. The mission 
could continue as planned. 

Later, engineers speculated that the 
small space between the two hatch 
seal beads had a lower pressure than 
the space station cabin—possibly 
even a vacuum. This lower pressure, 
due to the large hatch size, was 
effectively “sucking” the hatch 
against the MPLM bulkhead until 
enough force could be put into the 
hatch to overcome this pressure force. 

Sometimes, when it comes to getting 
hardware to work correctly in the 
extreme environments away from 
Earth—despite the best designs and 
pre-laid plans to resolve problems—a 
good tap, nudge, whack, or shove 
may ultimately do the trick. 
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The Mod Kit 

Short for “modification kit,” a mod 
kit is a collection of equipment 
that needs to be installed on the 
ISS (usually inside, but sometimes 
outside, as well) to accommodate 
new hardware or new functions on 
the spacecraft. Mod kits can be small 
in size, or they can be quite large 
and complex. The need to install a 
mod kit usually presents a relatively 
rare opportunity to renovate and/or 
remodel the space station. Installation 
of a mod kit often requires the use 
of the many different maintenance 
techniques mentioned in this chapter. 

An example of a relatively small 
mod kit was the transition away 
from a large, single ORU in the urine 
processor that both filtered and stored 
pretreated urine. The large, single 
tank was being disposed of when 
the urine container was at its end of 
life, even though the filters (which 
were contained inside the tank) still 
had a much longer life available. 

The mod kit replaced this single 
component with a number of smaller, 
individual filters and a separate urine 
containment tank. The new design 
allowed for each subcomponent to 
be used until it had reached its own 
end of life. The mod kit contained 
the various separate filters, urine 
tank, and hoses to connect them all 
together. In this case, the OSO flight 
controller’s job was to determine 
how to best install the new hardware 
to make sure it would all fit inside the 
rack that was designed and built to 
accommodate the single, larger ORU. 


An example of a much larger mod 
kit is the project to reconfigure the 
ISS to support the Commercial 
Crew Program. This renovation 
requires the relocation of the 
Permanent Multipurpose Module 
and PMA3 module, installation 
of new docking adapters and 
control panels to operate them, and 
installation of new equipment so 
the ISS can communicate with the 
new commercial crew vehicles. 
New power and data lines will 
run throughout the US Segment 
to connect the new hardware, and 
to ensure full functionality of the 
modules that were relocated. A 
number of software changes on 
the ISS are also required to ensure 
the ISS MDMs know how to 
communicate with and control the 
new and reconfigured equipment. 

A number of mod kits are involved 
in this US Segment reconfiguration. 
Planning and coordinating the 
implementation of this major 
rearrangement is being done across 
all of the flight control disciplines, 
the ISS Program, engineering 
organizations, and the various ISS 
Program contractors. The mod 
kit components and hardware 
will not all arrive at the ISS at the 
same time. They will launch to 
the ISS over a span of a number 
of years. Thus, choreography of 
what can be installed or relocated 
is as important as developing the 
maintenance procedures to actually 
perform the work. The first mod 
kit installation on the ISS for this 
effort occurred in January 2015, 
and completion is expected in time 


to support the first docking of a 
commercial crew vehicle in 2018. 
This major renovation work is also 
choreographed to ensure that the 
ISS and its crew can remain focused 
on the primary ISS mission of 
performing as much research and 
scientific investigation as possible. 

Conclusion 

Maintenance is a key factor in 
keeping the space station fully 
functional to support not only the life 
and livelihood of its crew but also its 
primary mission of unique off-Earth 
scientific research. Maintenance 
comes in a wide variety of forms, 
from simple cleaning and hardware 
replacement to intricate diagnostics 
and component repair. Repairs 
have proven successful through 
prepositioning supplies, detailed 
pre-launch training, and teamwork 
between the ground and crew. 

Often, adaptability and ingenuity 
has been required for problems 
that were not always anticipated. 

A copious supply of tape and 
resourcefulness from all involved has 
also proven to be a key factor, and 
will undoubtedly remain so for the 
rest of the space station program. 
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Chapter 17 Systems: 

Extravehicular 
Activities—Building 
a Space Station 




Astronaut Mike Hopkins participates in the second of two US spacewalks to change out a faulty external pump on the International Space Station (ISS). Visible 
in his helmet visor are Rick Mastracchio (Hopkins’ partner on the spacewalk), the ISS robotic arm, and some ISS structure and solar arrays. Dec. 24, 2013. 


Something about seeing an 
astronaut in a spacesuit captures 
the imagination of children and 
adults alike . Perhaps the human 
shape of the spacesuit against the 
backdrop of Earth gives one a sense 
of human fragility, or maybe looking 
at the suit is a little like glimpsing at 


a futuristic human race. The general 
public can tell just by looking at a 
photo that “walking” in space while 
attached to the vehicle by a tenuous 
lifeline is one of the most dangerous 
pursuits. A spacewalker wears a 
personal spacecraft that must provide 
protection from the freezing cold of 


space, the burning heat of the sun, 
and the small pieces of space debris 
that could come hurtling at him or 
her at thousands of miles per hour. 
The reality is that astronauts and 
Mission Control are hyperaware of 
such dangers during a spacewalk. 
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The Foundation for 
International Space Station 
Spacewalks 

Spacewalks—or extravehicular 
activities (EVAs)—performed on 
the International Space Station 
(ISS) evolved from a rich history of 
spacewalk experience starting in 1965 
with the first Soviet and American 
spacewalks and continuing through 
subsequent human space programs. 
Spacewalks continued to evolve when 
the ISS came along since building 
the station required an unprecedented 
number of EVAs. The ISS is almost 
four times as large as the Russian 
space station Mir and about five times 
as large as the US Sky lab, with a 
design that demanded a lot of manual 
bolting together of components and 
hand-mated connections. 


As the timeline for construction 
of the ISS approached, EVA teams 
looked at the daunting task of 
assembly as the “Wall of EVA” 
(Figure 1) since the amount of EVA 
time would rise rapidly compared 
to prior years. As of Expedition 51 
in 2017, astronauts had completed 
more than 1243 EVA hours in 191 
EVAs for the ISS, including 28 Space 
Shuttle-based EVAs. Astronauts and 
cosmonauts conducted roughly 80% 
of ISS EVAs in US spacesuits, and 
the rest were conducted in Russian 
spacesuits out of a Russian airlock. 

For comparison of the US programs, 
the Gemini Program conducted nine 
EVAs (the first of which was only 
20 minutes long, compared to today’s 
standard planning of 6+ hours per 
EVA), the Apollo Program conducted 
five spacewalks and 21 lunar 


“moonwalks,” and Skylab conducted 
10 EVAs. Prior to ISS assembly, 
astronauts conducted 41 EVAs during 
Space Shuttle flights over the course 
of 15 years. 

Looking back now at the Wall of 
EVA, NASA’s expectations were 
right on the money. These spacewalk- 
heavy years were extremely intense 
and challenging for the Space Shuttle 
and ISS teams. But these years were 
also incredibly rewarding, with the 
creation and growth of the space 
station occurring one EVA at a time. 

The Space Shuttle Program provided 
the major basis for US EVA hardware 
and techniques for the ISS since the 
shuttle was bringing up the United 
States On-orbit Segment elements 
for installation and assembly. 
Furthermore, the US Segment was 
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Figure 1. US EVAs over the course of NASA’s history through mid 2017. The Wall of EVA hours looked daunting to the EVA teams as the ISS Program approached. 
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Figure 2. Astronaut Mark Lee tests the nitrogen-propelled backpack that would be needed for the ISS. Space Shuttle mission STS-64 (September 1994). 


built largely by shuttle crews that 
wore shuttle spacesuits. 

During the ISS design development, 
NASA conducted specific Space 
Shuttle EVA experiments to 
determine acceptable ways to 
assemble a space station and 


understand new requirements for 
EVA equipment. This process 
included testing designs for 
assembling a truss structure and 
new EVA tools for an extravehicular 
crew member who had to maneuver 
around a large ISS structure. 
Although all ISS EVAs include 


having the crew member tethered 
by lifeline to its structure, shuttle 
crews tested a nitrogen-propelled 
backpack flown by extravehicular 
crew members using a joystick 
(Figure 2). This backpack—called 
Simplified Aid for EVA Rescue 
(SAFER)—can be used in case an 
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astronaut “falls off’ of the ISS since 
the space station is not able to chase 
after a lost crew member as the Space 
Shuttle theoretically could have done. 

The focus of this chapter is on US 
spacewalks using the US spacesuit, 
which is called the Extravehicular 
Mobility Unit (EMU). However, 
Russian EVAs (using the Orlan 
spacesuit out of a Russian Segment 
airlock) have also contributed greatly 
to the construction and maintenance 
of the ISS. US EVA experts spent 
a number of years during early ISS 
construction temporarily living in 
Moscow to work with Russian EVA 
experts for the purpose of negotiating 
crew training, spacewalk techniques, 
and hardware use. Spacewalks 
have been conducted by Americans 
in Orlans and Russians in EMUs 
(plus other international partners in 
both suits), and training has been 
conducted in both countries in both 
spacesuits. In fact, early in the 
program, it was envisioned that the 
US Segment airlock would be used 
for both Orlan and EMU EVAs. 

The airlock was built accordingly to 
accommodate both suits. The airlock 
Quest on the US Segment is called 
the Joint Airlock for that reason. 
However, having Orlan operations 
on the US Segment has not been 
needed as much as anticipated, and 
Russian Segment tasks are closer 
to the Russian airlock. Therefore, 
some of the equipment that the 
Joint Airlock would require for an 
Orlan EVA was not launched for 
installation in the airlock (notably, 
the Orlan umbilicals needed for 
oxygen, cooling, power, and 
communication while the crew 
member was still in the airlock). All 
Orlan EVAs have been executed out 
of Russian Segment airlocks, to date. 


The US Spacesuit 

The iconic white US spacesuit 
has to provide the functions of a 
spacecraft while being wearable. 

Its design is mostly unchanged 
from the Space Shuttle Program, 
although some features and 
components evolved during ISS 
operations. For example, the Space 
Shuttle EMUs were designed to 
be used for the short duration of a 
shuttle mission—i.e., no more than 
a handful of EVAs—and returned 
to Earth for servicing before use on 
a subsequent flight. It was desirable 
to leave the EMUs on the station 
for longer periods of time since 
launching bulky spacesuits over 
and over to the ISS is expensive 
and would mean other things 
couldn’t be launched in their place. 
The spacesuit contractor extended 
the life of EMUs by replacing some 
parts and testing others for longer 
life to enable them to remain on 
orbit for several years without 
periodic ground checks. Another 
upgrade was to toughen some of the 
material on the gloves. Astronauts 
use their hands to maneuver around 
the ISS, thus the glove material 
had to be strengthened to withstand 
extended wear and provide more 
protection against the sharp edges 
that develop on the exterior of the 
station over time. Although almost 
all of the external hardware is 
manufactured to have smooth edges, 
Micrometeoroid and Orbital Debris 
(MMOD) strikes on the ISS surface 
over the years have produced various 
cuts and protrusions in the metal 
handholds and on other surfaces. 

The material upgrade was made after 
the crew discovered a number of 
cuts in the outer layer of the gloves 
following EVAs. 


The EMU (Figure 3) provides the 
fundamental needs for a crew member 
on a spacewalk lasting approximately 
6.5 hours. It provides pressure 
and an oxygenated atmosphere, 
environmental protection from 
extreme temperatures/radiation/ 
some space debris, mobility, and 
communications. Sometimes, 
the EMU can provide these 
fundamental needs for more than 
6.5 hours, depending on the thermal 
environment, specific crew member 
metabolic rate (which determines 
how much oxygen he or she breathes 
and how much carbon dioxide is 
produced), and the difficulty or 
workload for a given EVA. In addition 
to the expected 6.5 hours, the suit 
allows the team to manage 30 minutes 
of additional capability (e.g., oxygen 
and other consumables, such as 
battery power, that are used during 
an EVA) as pure margin to ensure the 
crew member gets back inside the 
station before critical supplies run out. 

The EMU breathing environment 
during an EVA is pure oxygen at 
217 millimeters of mercury (mm Hg) 
(4.3 pounds per square inch [psi]), 
which is equivalent to approximately 
9 km (30,000 ft) altitude simply in 
terms of pressure. This environment 
was originally chosen based on 
historical knowledge of pressure 
suit systems, and it accommodated 
several competing requirements for 
Space Shuttle EVAs. A spacesuit 
needs a strong pressure bladder to 
retain the atmosphere, as well as 
restraining material to conform the 
suit to a human and hand shape. 
Lower pressure is necessary to 
allow for the mobility required to 
grasp tools and move around the 
structure while working inside 
the bladder and restraints. Even at 
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Figure 3. The major components that make up the EMU. 
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217 mm Hg (4.3 psi), working in 
the suit can be fatiguing, especially 
for a crew member’s hands. At 
pressures this low, air does not supply 
the necessary quantity of breathing 
oxygen, hence the pure oxygen 
atmosphere. The lowest allowable 
oxygen pressure in which humans 
can operate safely is approximately 
160 mm Hg (3.1 psi). However, a 
pressure that low does not allow 
any margin for suit leaks or normal 
variation in system components. 

Very low suit pressure also increases 
the risk that the crew member will 
develop decompression sickness 
(DCS)—i.e., “the bends” that scuba 
divers work to avoid. Therefore, 
the EMU pressure of 217 mm Hg 
(4.3 psi) was selected in a balance of 
these factors. 

Oxygen is supplied by the primary 
oxygen supply tanks (-44000 mm Hg 
[850 psi]). Or, if needed, oxygen can 
be supplied by the Secondary Oxygen 
Package (SOP) tanks (-258,GOO- 
310,000 mm Hg [5000-6000 psi]). 
The pressure regulation system uses 
the primary oxygen exclusively on 
an EVA unless the pressure in the suit 
drops to approximately 201 mm Hg 
(3.9 psi) due to primary oxygen 
depletion or a leak in the suit. At 
that point, the SOP will “come on 
line” to keep the suit pressure around 
201 mm Hg (3.9 psi). The SOP tanks 
are sized to provide enough oxygen 
to keep the suit pressurized while the 
crew member quickly translates back 
to the airlock in the case of a small 
leak, and also for potential failures 
that would require the crew member 
to “purge” the suit by intentionally 
opening one of two small holes to 
allow gas to flow out. Purging might 
be needed if, for example, the fan 


shuts down and dangerous levels 
of exhaled carbon dioxide start to 
accumulate in the helmet. In these 
cases, the primary oxygen tanks will 
become depleted faster, requiring the 
SOP to provide the necessary make¬ 
up oxygen to allow the crew member 
enough time to reenter the airlock. 

During an EVA, a fan circulates 
the oxygen, and the crew generates 
carbon dioxide, heat, humidity, 
and other contaminants. The flow 
is forced through a Contaminant 
Control Cartridge (CCC), which is a 
replaceable container that “scrubs” 
(i.e., removes) carbon dioxide and 
other contaminants from the gas 
environment. The CCC contains 
filters and charcoal to remove 
contaminants and odor, and either 
heritage Space Shuttle-based lithium 
hydroxide (LiOH) or ISS-based metal 
oxide (Metox). The LiOH or Metox 
removes carbon dioxide through a 


chemical reaction, introducing heat 
and water vapor into the oxygen 
flow. After the flow is cooled and 
humidity is condensed out, the 
newly scrubbed oxygen combines 
with fresh oxygen from the primary 
system and is introduced to the crew 
member’s helmet, blowing over 
the face. The CCC is changed out 
prior to each EVA. LiOH cartridges 
are used only one time, whereas 
Metox is a regenerable cartridge that 
was created for ISS use and can be 
reused on a subsequent EVA after 
the carbon dioxide is removed using 
a specialized heating system in the 
airlock (Figure 4). 

Temperatures in low-Earth orbit 
reach extremes of approximately 
-93°C to +149°C (-200°F to +300°F). 
The EMU keeps the crew member 
comfortable, although he or she can 
get too hot or cold depending on a 
variety of situations. Factors include 



Figure 4. Some key life support system components in the backpack of the EMU. 


SYSTEMS: EXTRAVEHICULAR ACTIVITIES-BUILDING A SPACE STATION CHAPTER 17 


285 


Credit: “Suited for Spacewalking: An Activity Guide for Technology Education, Mathematics, and Science, 
EG-1998-03-112-HQ.” 














Micrometeoroid and Orbital Debris 

Spacecraft in orbit around the Earth encounter small fragments 
of rock called micrometeoroids (as opposed to meteorites, 
which are larger pieces of rock that survive reentry into 
Earth’s atmosphere). Orbiting spacecraft also encounter a 
growing amount of debris such as rocket bodies and pieces of 
spacecraft that have exploded. Collectively, these particles are 
called MMOD. The entire ISS must be maneuvered to dodge 
larger pieces that could slam into the station and create a large 
hole in the structure. However, the ISS is constantly exposed 
to tiny particles that are too small to track from the ground 
(Figure 5). This issue is discussed, in greater detail, in Chapter 8. 

Partway through the ISS assembly, serious cuts in the 
EMU gloves were seen, which caused alarm within the 
EVA community. ISS EVAs were already rough on an 
astronaut’s gloves due to connector manipulation and moving 
long distances, but crews also started pointing out and 
photographing more and more MMOD strikes on the ISS that 
could be contributing factors. When a piece of debris strikes 
the ISS, it can leave a small pit or hole with sharp points that 
could tear an EMU glove (Figure 6). Initially, the crew was 
told to mark an MMOD strike with a wire tie (i.e., a few inches 
of wire similar to a coat hanger) by wrapping it around the 
handrail as a visual indication to the next astronaut. However, 
the strikes became too numerous. Crew members are now 
given a briefing where they view several photos that show the 
many known MMOD strikes. The message to the crew: Look 
before touching. Each time an astronaut performs an EVA, a 
new strike might have happened since the last EVA. The EMU 
glove materials were upgraded to be more durable, but the 
gloves are still carefully photographed and inspected after each 
EVA. Tethers—a crew member’s lifeline to the ISS—are also 
inspected for MMOD strikes before reuse. 

Depending on the EVA, the calculated odds are approximately 
1 in 8000 that an EVA crew member’s spacesuit will be struck 
by MMOD during that EVA, although the strike would have 
to create a hole approximately 4 mm (0.2 in.) or larger to 
be fatal. The odds that any crew member, inside the ISS or 
performing an EVA, will not survive because of an MMOD 
strike to the ISS are around 1 in 120 over a 6-month period, 
since a hurtling piece of debris could puncture a pressurized 
module and cause rapid depressurization that is too fast to 
allow astronauts or equipment to react. 



Figure 5. Two views of an MMOD strike on a tool that had been 
on the ISS exterior, exposed to the elements. The crew found this 
crater during Space Shuttle mission STS- 123/ISS- 1J/A. 



Figure 6. Glove tears that were noted during an EVA on 
STS-118/ISS 13A.1, causing the flight control team to terminate 
the EVA (i.e., bring the crew member back into the airlock early) 
as a preventative measure. Fortunately, the bladder that holds 
in the oxygen and keeps pressure on the astronaut was not 
damaged. Only the outer layers and fabric were affected. 
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Figure 7. An LCVG, with its small water-filled tubes throughout and larger yellow ventilation ducts on 
the shoulders, floats in the airlock. The water tubes and ventilation ducting come together at the right 
waist with a connection point to the spacesuit. The fan/pump/water separator in the suit’s backpack 
(not shown) provides the circulation. Shoulder pads provide a cushion from hard points in the suit and 
help fill some volume for an overall snug and comfortable fit. 


whether the crew member is shaded 
from direct sunlight, whether the 
tool or the contact surface tends to 
absorb or reflect heat, and the crew 
member’s activity level relative to the 
cooling system of the suit. Cooling 
is performed both passively and 
actively. Passive thermal control and 
radiation protection is provided by the 
outer suit layers that reflect sunlight 
and provide insulation. Active cooling 
removes generated and absorbed heat 
via a circulating water system with 


a component called the sublimator. 
Tanks supply water to form a sheet 
of ice on the sublimator, which is 
exposed to the vacuum of space. In 
a vacuum, the ice sublimates (i.e., 
transitions directly from a solid to 
the gas phase without going through 
the liquid phase), removing heat as 
part of the process. Oxygen that is 
being circulated through the CCC and 
fan passes through the sublimator to 
provide cooling of the circulating gas 
and to condense out excess humidity. 


Water is circulated over the crew 
member’s body via the Liquid 
Cooling and Ventilation Garment 
(LCVG), which is an internal 
bodysuit with approximately 91m 
(300 ft) of thin flexible tubing sewn 
into the fabric. Ventilation ducting 
provides oxygen circulation in the 
arms and legs of the suit, thus the gas 
in those areas is also cleansed and 
dehumidified (Figure 7). 

In addition to providing thermal 
control, the carefully crafted multiple- 
layer composition of the suit is a 
stack of nylon, insulation, and fabric. 
Its design holds in the pressure, 
restrains the suit to conform to the 
body, and provides some protection 
from suit leaks due to small MMOD 
hits or punctures from tools or sharp 
objects on the ISS. The outer garment 
protects the internal pressure bladder 
(i.e., coated nylon “balloon” that 
keeps the pressure in) with materials 
that help protect against abrasion, 
puncture, and damage propagation. 

In other words, the design intention 
is such that a small hole is less likely 
to become a huge rip as the crew 
member moves around in the suit. 

Communication with other 
spacewalkers, the ISS, and the 
ground occurs through an ultra-high 
frequency (UHF) radio system, 
at a frequency that is lower than 
that used in car alarm systems and 
walkie-talkies (see Chapter 13). UHF 
antennas are located in the airlock and 
on the outside of the space station to 
transmit communication and some 
EMU status information to the ISS. 
That information is relayed to the 
ground through the standard space 
station communication system. Each 
EMU has a primary radio and a 
backup radio (as does the UHF system 
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on the ISS) to ensure communications 
are not lost. Crew members wear a 
communication cap (i.e., a “Snoopy” 
cap) with a microphone boom. The 
microphone is set to transmit without 
requiring the crew member to push a 
button on the suit. Everything he or 
she says can be heard, assuming the 
communication links are good. Each 
crew member’s electrocardiogram 
data are also transmitted over UHF 
so that flight surgeons in Mission 
Control can monitor the health of 
each astronaut during the activities. 
EVAs are strenuous. Prevention 
of a serious health issue is critical 
since treatment is difficult, if not 
impossible, until the crew member is 
back inside the space station. 

The Display and Control Module is 
the brains of the suit and includes 
a Liquid Crystal Display readout, 
switches, and a pressure gauge. The 
crew display is somewhat similar to 
a car or cockpit’s computer readout 
system. It gives the crew member 
insight into the health of his or her 
suit, including audible alarms through 
the Snoopy cap, when required. Since 
a crew member can’t see the front 
of his or her chest when in the suit, 
a wrist mirror is used to look at the 
controls on the front of the suit, which 
is why the labeling is backward. 

The Cuff Checklist—a small binder 
attached to the crew member’s 
wrist—contains reference instructions 
and emergency procedures (Figure 8). 

The EMU is sized for each crew 
member through a modular approach, 
with various sizes and lengths for 
the main torso and other parts. Fit is 
further improved with sizing spacers 
and fine adjustment tabs in the suit, 
although EMUs are still notoriously 



Figure 8. The EVA Cuff Checklist (bottom) is a small book worn on the wrist (top) that the crew can 
reference for steps to perform during normal operations and in emergency situations. The crew often 
prints out new pages sent from Mission Control Center or writes on blank pages with some additional 
reminders just before an EVA. 
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Figure 9. EMU components are specifically picked out for each crew member so the suit can be appropriately sized. Shown are: (left) the Lower Torso 
Assembly with boots and metal sizing rings pictured; (center) an EMU glove; and (right) a sizing ring for lengthening an arm. 


difficult to size perfectly (Figure 9). 
Crew members often have their own 
gloves made to fit their hands, or they 
use another crew member’s gloves 
if they are a good approximation 
and available for their flight. The 
spacesuits cannot stay on orbit 
indefinitely, and there is not enough 
storage space to accommodate 
multiple sets of every sized piece. 
Thus, ground teams work on EMU 
logistics to ensure the various parts, 
including spares, get launched and 
are on orbit for each crew member. 
Wrinkles in these complicated 
logistics can occur, as was the case in 
the destruction of the Cygnus cargo 
vehicle on October 28, 2014, when 
the rocket carrying Cygnus exploded 
shortly after liftoff (Chapter 14). The 
cargo mission was carrying EMU 
equipment, including a sized LCVG 
for one crew member, as well as a 
SAFER unit and several tools and suit 
maintenance items that had to be sent 
up on a later mission. A SpaceX cargo 
vehicle was also lost during launch 
on June 28, 2015, resulting in the loss 
of an EMU life support system and 
upper torso that was being sent up for 
its freshly refurbished parts. 


The EMU offers quite a bit of 
functionality, considering its 
small size as a spacecraft. It has a 
rechargeable battery for powering 
the various components when out 
on an EVA. A crew member can pull 
down a sun visor on the front of his 
or her helmet to act as sunglasses 
when orbital night turns into brilliant 
orbital day approximately every 90 
minutes (a sunrise or sunset occurs 
approximately every 45 minutes). 
Helmet lights are used for operations 
at night, and a television camera is 
mounted to the helmet so the ISS 
crew inside and the flight controllers 
on the ground can monitor the 
extravehicular crew’s activities. Crew 
physiology support includes a drink 
bag with a straw and a maximum 
absorbency garment (i.e., a diaper). 
After an incident where water 
entered a crew member’s helmet on 
US EVA 23, NASA equipped the 
EMU with a helmet absorption pad 
to absorb water on the head, as well 
as a snorkel similar to those used by 
scuba divers. The snorkel extends 
from near the mouth down to the 
waist so the astronaut can breathe 
oxygen from the body of the suit if 
the helmet fills with water. 


The Orlan (Figure 10) provides 
similar capability but is packaged 
differently. Example differences 
include rear entry through a hatch 
for quick self-donning instead of 
the EMU shirt-and-pants design, 
adjustable length sizing rather than 
modular parts, and a higher operating 
pressure (295 mm Hg [5.7 psi]). 



Figure 10. US astronaut Mike Fincke is working 
in a Russian Orlan spacesuit. Some US tools were 
used during this EVA, with adapters installed as 
needed so they could be used with the Orlan. 
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US Extravehicular Activity 23 Water-in-Helmet Incident 


During US EVA 23 on July 16, 2013, water entered 
astronaut Luca Parmitano’s helmet about an hour into 
the EVA. The crew, flight control team, and engineers on 
the ground did not understand the source of the water 
and initially thought it may have come from a leak in the 
drink bag. However, the increasing quantity and unknown 
source caused the flight control team to call for an early 
termination of the EVA. Parmitano started translating 
back to the airlock. On the way, the water migrated to 
his face, covering his eyes, ears, and nose. Since there 
was no gravity to pull the water away from his nose and 
mouth, he could potentially drown in space. His vision 
and communications were degraded, and he had to use 
his safety tether as a guide to get into the airlock. Both 
crew members made it back into the airlock. Via a series 
of hand squeezes, Chris Cassidy (the other crew member) 
confirmed Parmitano was okay while they performed an 
airlock repress and suit doffing. After the EVA, the crew 
reported approximately 1.5 liters (0.4 gallons) of water in 
Parmitano’s helmet. This quantity matched the amount 
that was later determined to be missing from the water 
tanks that fed the sublimator during the EVA. Looking 
back, it was clear that Parmitano nearly drowned in the 
suit, and that the quick actions taken by the crew and 
ground team saved his life. 

Prior to this incident, crew procedures did not mention 
what to do if this quantity of water was in the helmet. 


This is because spacesuit testing on Earth showed that the 
fan would shut down and the water system would close off 
if a large quantity of water entered the ventilation system. 
However, in a zero-gravity environment, water can form a 
thin layer on the wall of the fan housing, flowing along the 
wall without stopping the fan blades as it would on Earth. 
The teams realized this fairly soon after the incident and 
then focused on determining how the water had entered 
the ventilation system in the first place. 

Because the investigation was expected to take quite 
some time, the team worried about calling a halt to EVAs 
for several months. The team needed to have the ability 
to perform EVAs while the investigation was ongoing. 
Without knowing the failure’s exact cause (root cause), 
the team developed procedures to have the crew to take 
safing actions and return to the airlock if this happened 
again. A helmet absorption pad, which was attached 
by Velcro to the inside of the helmet, and a snorkel that 
extends from the crew member’s mouth down to the waist 
area were designed and quickly flown to the ISS. 

The EMU has a fan for oxygen ventilation, a pump for 
water circulation, and a water separator for condensation 
gathering that are coupled together through a common 
shaft and magnetism. The unit is called the Fan/Pump/ 
Separator (Figure 11). The water separator portion of the 
FPS in Parmitano’s suit had become clogged with tiny 
particles, causing water to back up and deposit into the fan. 


Planning and Training 
Extravehicular Activity Tasks 

When the external portions of 
the ISS were being designed, the 
engineers and managers often made 
compromises between how much 
time would be spent assembling 
or repairing a component via 
EVA versus the use of robotic or 
automated systems. Many factors 
had to be considered, including the 


complexity of performing a task in 
space by a human or a robotic arm, 
the mass or size of the item, the 
cost of manufacturing the hardware 
or software for each option, and of 
course the schedule. To reduce the 
amount of EVA time to assemble the 
ISS, engineers designed modules 
and some truss segments with 
automated bolts and power and data 
connectors to create a permanent 
interface. When possible, automated 
mechanisms deployed appendages 


such as antennas and solar arrays 
that had to be tucked down to a 
lower profile to fit in the cargo bay 
of the Space Shuttle. However, 
having a human perform a spacewalk 
allowed for lower-complexity 
designs with simpler bolts or 
mechanisms driven by powered 
drills that were held by EVA crew 
members. Also, an EVA crew could 
assist with human intervention 
to save the day when automated 
systems encountered a failure. 
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EMU with backpack facing Steve, who unzipped the white thermal 
cover and tilted the suit down to access the suit components. 



The investigation found that some filter devices used 
to clean the water system of the suit during periodic 
maintenance (to control microbial growth and take out 
other contaminants) were inadvertently exposed to 
impure ground water. These were launched to the ISS 
and used with Parmitano’s suit and the other suits, 
and were likely the source for the majority of the 
particles that caused the clog. Numerous potential 
contributing factors were associated with Parmitano’s 


Figure 11. Astronaut 
Steve Swanson holds a 
Fan/Pump/Separator unit 
(with protective cylinder 
installed on the end). 
Several of these units 
were changed out in 
the on-board suits due 
to failures, as well as to 
investigate the cause of 
an incident on US EVA 23 
where water entered a 
crew member’s helmet. 
The EMU is installed in a 
rack that assists with suit 
donning, and it is tilted 
down with the backpack 
cover unzipped to expose 
the suit’s life support 
system. Below the EMU is 
the tether stowage area in 
the Equipment Lock. 


suit (e.g., excessive grease could have been in the 
system, applied to the seals). 

The airlock system was flushed with water, several EMU 
components were changed out, and the filters in question 
are now carefully manufactured with pure water flowing 
through them. The helmet absorption pad and snorkel 
are used for all US EVAs. Crews and ground teams are 
now very well trained for this failure mode. 


After weighing the various factors 
for each interface, the ISS and 
especially the US Segment ended 
up requiring a lot of EVA time to 
assemble. Use of the large Canadian 
robotic arm is often still required 
to reach otherwise-inaccessible 
areas of the ISS and to secure an 
astronaut’s feet so he or she can grip 
something with both hands (e.g., 
while moving an item to another 
area on the ISS). 


On paper, the tasks needed for ISS 
assembly—e.g., driving a bolt, 
carrying something from one place to 
another, taking off a cover, plugging 
in an electrical cord—might not seem 
too complex. However, conducting 
such tasks while wearing a spacesuit 
with pressurized gloves (possibly 
with one’s feet planted on the end 
of a long robotic arm), working in 
microgravity, maneuvering around 
huge structures while moving massive 
objects, having time constraints based 


on spacesuit consumables, and using 
specialized equipment and tools made 
these tasks and EVAs challenging. 
Tasks such as working with cables 
or fluid hoses (Figure 12) are hand¬ 
intensive work—fingers and forearms 
get quite a workout in pressurized 
gloves that feel like stiff balloons 
and resemble oversized garden 
gloves. Added to these complexities, 
space “walking” is mostly done 
with the hands. The astronaut grasps 
handholds and maneuvers the 
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Figure 12 . Modules had to be connected, by hand, with stiff hoses for ammonia transfer as well as electrical power connections. Hand and EMU access was 
often tight. The crew had to carefully avoid snagging the lines with tools and tethers. The actual “flight hardware’’ connections were piecemeal tested to the 
extent possible, but the full three-dimensional (3-D) geometry with the crew in real EMUs was impossible to fully simulate on the ground. The Laboratory (top) 
and Node 1 (bottom) are the silver modules under all of the cabling in this photo from STS-110/ISS-8A. 


combination of the EMU, SAFER, 
tools, and himself of herself around 
the structure. 

The team on the ground has to come 
up with a choreography and order 
of events for the EVA, in advance. 
The flight control team creates the 
EVA timelines based on a high-level 
prioritized list of tasks determined 
by ISS management (e.g., move a 
specific antenna, install a particular 
avionics box). The flight controllers 
start with the top ISS priority task 
and assesses the other tasks that can 


fit into the EVA based on multiple 
factors such as how long the tasks 
will take based on past experiences, 
whether both crew members need to 
work together, task location on the 
ISS, how much equipment will fit 
into the airlock, the tools required, 
crew experience level, and the level 
of crew effort to complete the task. 

A task that might fit (but only if the 
team is efficient) is put on the list as a 
“get-ahead” task. See also Chapter 4. 
Real-time discussions in Mission 
Control of EVA time remaining, 
crew fatigue, and suit consumables 


could allow the get-ahead task to 
be accomplished in addition to 
the planned tasks. Some tasks are 
performed on a “clock”; i.e., if power 
is removed from an item, it might 
get cold and need heater power in a 
matter of hours or sometimes within 
minutes to prevent damage. While a 
timeline is still in a draft version, the 
team conducts testing as required to 
prove out the operations. The team 
then trains the crew and refines and/or 
changes the timeline, sometimes up to 
the day of the EVA. 
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Extravehicular Activity 
Testing and Training 

Testing and crew training for an EVA 
takes place in many facilities due 
to the complexities associated with 
adequately mimicking microgravity, 
working in a spacesuit, and the 
large scale of the ISS. One of 
the main facilities used for EVA 
development and crew training is 
the Neutral Buoyancy Laboratory 
(NBL)—a large pool that measures 
approximately 61m (200 ft) long by 
30 m (100 ft) wide by 12 m (40 ft) 
deep—near Johnson Space Center in 
Houston, Texas (Figure 13). Training 
versions of EMUs are balanced by 
scuba divers with weights so the test 
subject does not sink or float and 
can work as he or she would in zero 
gravity. The underwater suits each 
use an umbilical hose that goes to 
the surface to supply breathing gas 
and cooling. The divers manage this 
umbilical, thus the crew usually does 
not know it is there. Water does not 
provide a perfect model for space— 
the ISS mock-up and tools corrode 
over time, the water drag makes 
large objects (including the crew 
members) harder to start moving and 
easier to stop moving than in space, 
and equipment is inclined to float 
or fall in a manner that it would not 
in space. Also, the ISS is so big that 
the entire structure does not fit in 
the pool, so it is broken into pieces. 
When the crew members translate 
along the ISS structure in the pool, 
the divers must assist by physically 
moving the crew members between 
parts of the ISS when there is a gap 
between structures (Figure 14). 

The NBL replaced the Weightless 
Environment Training Facility at 



Figure 13. The NBL near Johnson Space Center. Above the water level is the control room, a mini 
Mission Control, visible on the far right behind the white wall. The yellow cranes are used to hoist crew 
or other test subjects into the water. The crew must use special EMUs that are made to be used in the 
water. The mock-ups underwater include the Laboratory Destiny with the central piece of the truss 
structure on top (farthest away), truss and solar array structures (center and right), and the Space 
Shuttle’s cargo bay (foreground). 



Figure 14. An astronaut (i.e., the test subject) translates along the forward face of the mocked-up ISS 
truss, with a scuba diver assisting to keep the air and cooling umbilical from becoming entangled or 
pulling on the EMU. 
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Figure 15. The Precision Air Bearing Facility, with a test subject inside an EMU. Air blows out of pads 
on which the EMU is resting, so the unit will slide based on how the person inside the EMU moves or 
when pushed. In this case—a test that followed the Columbia accident—the subject was pushed to 
slide along the floor as if flying a SAFER while using a tool to measure damage to Space Shuttle tiles. 


Johnson Space Center and is where 
most of the EVA choreography 
is currently tested. However, the 
Weightless Environment Test System 
in Tsukuba, Japan, and the Neutral 
Buoyancy Simulator in Huntsville, 
Alabama, have also made major test 
contributions to ISS EVAs. 

Space Shuttle crews for ISS assembly 
missions were trained multiple 
times in the NBL on their EVA 
choreography using the specific 
tools and required tethers. ISS crews 
remain on station for a much longer 
amount of time, and they have long 
preflight training periods in multiple 
countries and can’t be expected to 
remember fine details for extended 
periods. EVA priorities often change 
after months of ISS operation 
anyway. Therefore, the ISS crews are 
trained on some specific EVA tasks, 
but their training focuses mainly on 
skill building (e.g., giving robotic arm 
operator directions, rescuing the other 
EVA crew member) rather than on 
memorizing choreography. 

EVA teams use a variety of other 
locations for testing and training. 
Vacuum chambers are used to verify 
that spacesuits do not leak in the 
vacuum of space. They are also 
used to test when reduced pressures 
(sometimes coupled with extreme 
temperatures) might affect operations, 
such as with the friction between 
moving parts, bubbling of substances, 
or stiffness of hoses. Moving massive 
objects by hand is not feasible when 
simply standing on the ground, so 
teams put high-mass objects on a 
system that blows air onto a polished 
steel floor and allows movement 
via principles similar to an air 
hockey table (Figure 15). This gives 
astronauts and test subjects a more- 


realistic feel for starting and stopping 
movement of heavy equipment since 
neutrally buoyant objects in a pool 
still tend to twist and float when 
affected by trapped air. 

Another key training facility is 
the Virtual Reality laboratory, which 
allows the test subject to view a 
graphic ISS in 3-D (often while 
wearing a helmet with goggles). 

This makes it possible for the teams 
to envision the workspace and 
practice EVA-robotics choreography 
(Figure 16). 

One famous testing platform was 
the “Vomit Comet” aircraft that 
allowed for intermittent periods of 
weightlessness. The KC-135 
aircraft (later replaced by a DC-9) 
was outfitted to fly a parabolic 


trajectory and provide approximately 
20 to 25 seconds of microgravity 
at a time. This allowed for quick 
tests with flight-like materials that 
could not be done underwater or that 
needed microgravity. 

Often, the team proves out techniques 
and uses EVA tools on real flight 
hardware while it is still in an 
assembly facility on the ground. 

It is better for NASA to discover 
that something is too difficult to 
reach/manipulate/tum by EVA crew 
members, or that tools don’t fit their 
interface, while on the ground rather 
than in space. Hardware obviously 
cannot be ground-tested in this way 
after it is already on orbit, which 
adds to the challenge now that ISS 
assembly is complete. 
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Figure 16. Astronaut Dan Burbank flies a mocked-up SAFER unit in the Virtual Reality laboratory. He 
is seeing the space station in 3-D and using the hand controller to ‘‘fly’’ back to the ISS. This provides a 
simulation of what it would be like if his tether broke and he detached from the structure. 


All told, the preflight EVA 
development process is fairly 
lengthy and complex. In an attempt 
to make designs EVA-friendly, 
with handholds and interfaces for 
standard EVA tools, NASA levied 
requirements on the ISS hardware 
designs. The operations team 
often works with the design team 
during development. Analysis and 
preliminary design would often 
lead to building mock-ups for 
preliminary testing underwater. EVA 
teams might test choreography for 
an EVA several times in the NBL. 
The teams also go to different 
facilities around the country to test 
the fit of tools, put together pieces 
of the real ISS, and try out putting 
blankets on structure—all things 
that cannot be done realistically 


underwater. Astronauts typically 
get into a spacesuit and go through 
the procedures for depressing the 
airlock to get a feel for the stiffness 
and sounds of a flight-like spacesuit. 
The crew slated for a spacewalk 
will practice flying SAFER in the 
Virtual Reality laboratory, as well as 
practice calling for robotic movement 
from the crew inside (e.g., “Move 
me down to the structure”). For 
assembly, crews would get into the 
real Space Shuttle cargo bay where 
ISS elements were located, as well 
as look at Space Shuttle interfaces 
in case of Space Shuttle off-nominal 
situations that might need an EVA. 
Astronauts may participate in other 
specialty classes and tests associated 
with tools or ISS hardware to further 
prepare them for a plethora of 


situations. After all is said and done, 
the EVA development effort involves 
many operations experts, hardware 
and EVA tool designers, analysts, 
experienced astronauts, safety 
experts, and facility experts. 

Extravehicular Activity Tools 

Tethers (cords) are critical for 
keeping hardware from floating 
away and act as lifelines back to 
the ISS structure (Figure 17). Some 
tethers are retractable and can be 
temporarily locked out (similar to a 
measuring tape), while others are a 
fixed length. Tethers are a constant 
source of discussion and can be key 
to the choreography, so the team 
carefully considers where a tether is 
best anchored on the crew member 
or structure. Work sites are often 
farther from the airlock than the 
length of a single tether, thereby 
requiring multiple tethers to be strung 
together or used in combination, 
which increases the complexity of 
getting somewhere and ensuring 
the astronauts always “make” (i.e., 
close the hook for) a connection 
before they “break” (i.e., open the 
hook from) the previous connection. 
Occasionally, a crew member can 
end up in a “snarl” or get snagged by 
a cord. In these cases, the astronaut 
must carefully untangle himself/ 
herself or the equipment, although 
the EVA choreography is designed to 
prevent such tangling. 

Crew members often use foot 
restraints when they need to work 
on something with two hands. In 
microgravity, actions such as pushing 
a piece of equipment or a tool would 
cause the astronaut to float in the 


SYSTEMS: EXTRAVEHICULAR ACTIVITIES-BUILDING A SPACE STATION CHAPTER 17 


295 













Trash Bag 


Foot Restraint (boot 
tips go under loops) 


Bag for small tools 

_ \ 


Cart for moving larger 
items down the front 
face of the ISS truss 


Pistol Grip Tool 


Tethers I"? $ 

m - 777 • 


Figure 17. This photo of astronaut Sunita “Suni” Williams was taken by astronaut Aki Hoshide during Expedition 32. A fairly standard quantity of tools can 
be seen on the front other spacesuit, although each EVA requires a somewhat different complement of tools. Two versions of safety tethers are attached to 
D-shaped rings on the suit near the hips, and one of these has a take-up reel that houses a 26-m (85-ft) steel cable. This safety tether can be attached to 
the structure and allows the crew member to travel far without having to relocate his or her tether point. However, if the crew member were to let go with only 
this cable attached, he or she could float away from structure and possibly come back to impact an unintended area off of the ISS. Other tethers are often 
used in addition to safety tethers, once a crew member arrives at the work area. A Pistol Grip Tool (under Williams’ arm) has functions similar to a cordless 
drill used for bolting and unbolting equipment. She is holding onto a cart that can translate along the truss but is rarely used for this purpose. 


opposite direction, something that 
doesn’t happen on the Earth where a 
person’s feet anchor the body against 
these forces. Another stabilization 
tool is the Body Restraint Tether—a 
device attached to the EMU that 
clamps to a handhold on the ISS 
and can be made rigid to hold a 
crew member steady. This tether is 
actually a stack of balls with a cord 
through the middle and a tightening 
mechanism, similar to a shop light 
or camera mount. A computerized 


Pistol Grip Tool is comparable to 
a sophisticated power screwdriver 
or cordless drill used to install or 
remove bolts when precise torque or 
turns are required. 

In addition to specialized tools for 
some tasks, common tools that were 
made EVA-friendly include wrenches 
and sockets, bags to keep tools 
contained, cameras, trash bags, etc. A 
tool mount called a Mini-Workstation 
on the front of the suit contains often- 
needed tools, ready and within reach. 


Extravehicular Activity 
Preparations and the Airlock 

For an EVA to be conducted, the 
crew has to get outside without 
taking the entire ISS cabin pressure 
down to vacuum. Thus, the suited- 
up EVA crew members go into a 
telephone booth-sized airlock that 
is depressed to vacuum just prior 
to the EVA. That small volume 
on the ISS that goes to vacuum is 
called the Crewlock, which is part 
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of a larger module called the Joint 
Airlock (Quest). The Joint Airlock 
houses the Crewlock and also has 
an Equipment Lock that holds EVA 
suits and equipment for storage and 
allows for suit donning and doffing. 

A Russian-designed depress pump is 
used to reclaim most of the Crewlock 
air for continued use in the cabin, 
rather than depressing the volume of 
the Crewlock by opening a valve to 
space in order to equalize with the 
vacuum of space (Figure 18). 

Airlock systems also provide vital 
consumables via umbilicals, or 
hoses, prior to the crew exiting the 
airlock. This allows the astronauts to 
complete their work before starting 
the spacewalk without using the 
limited quantities in the spacesuit. 
These consumables include oxygen 
and water, as well as power to avoid 
battery usage, “hardline” (i.e., not 
using radio) communication, and 
crew member cooling via an 
umbilical that attaches to the EMU 
on one end and an airlock panel on 
the other. When the team is ready 
to start the EVA, the astronauts 
disconnect the umbilical. If need 
be, the crew members can return to 
the airlock during an EVA to briefly 
connect the umbilical and refill 
oxygen, but this might not fit into a 
tight timeline if the worksites are far 
from the airlock. 

The morning of an EVA, the crew 
members get into the EMU by 
putting on the Maximum Absorption 
Garment, then a two-piece thin 
body undergarment resembling long 
johns for comfort under the LCVG, 
which will be put on next, followed 
by the pants (i.e., the Lower Torso 
Assembly) (Figure 19). The crew 
member gets into the upper portion 





Figure 18. Astronaut Doug Wheelock exits through the EVA hatch of the Joint Airlock. A thermal 
cover (shown directly behind him) keeps the airlock and its hatch at a stable temperature. This flap is 
closed by a Velcro fixture and must be opened when a crew member goes into or comes out of the 
hatch. The hatch itself cannot be seen in this photo because the hatch opens into the airlock. 

Figure 19. The EMU 

is donned by putting 
on the pants (Lower 
Torso Assembly) and 
then coming up from 
the bottom of the shirt 
(Hard Upper Torso). The 
crew member puts his 
or her arms through the 
sleeves and puts his or 
her head in the neck of 
the suit. The astronaut 
is usually assisted by an 
unsuited crew member 
when putting on the 
communications cap, 
mating the pants and 
shirt, and installing 
helmet and gloves. 
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of the suit by putting his or her 
arms through the suit arms mounted 
on a Hard Upper Torso, as if 
putting on a shirt over the head. 

The pants mate up to that Hard 
Upper Torso and seal in a ring 
around the crew member’s waist. 
Then, the communications cap, 
helmet, and gloves are donned 
as the suit gets powered up 
(Figure 20). After suit up, a leak 
check is performed to ensure the 
suit does not have any unexpected 
gas leakage—something as small as 
a human hair in between two seals 
will cause a noticeable leak and 
result in the crew having to double¬ 
check the connections. A leak check 
is accomplished by monitoring the 
pressure in the suit for 1 minute 
and verifying the pressure doesn’t 
change unexpectedly. 

One of the last things installed on 
the EMUs before an EVA is the 
SAFER, which the crew can use to 
fly back to the structure if tethering 
fails (Figures 2, 21, and 22). 

Prior to each EVA, an oxygen 
prebreathe is conducted to prevent 
the crew from getting the bends 
after depressurization of the 
airlock (i.e., when the absolute 
suit pressure drops to 222 mm Hg 
[4.3 psi]). This is the same DCS 
that ascending scuba divers as 
well as aviators at high altitudes 
must also prevent. Breathing 
100% oxygen forces nitrogen to 
migrate out of tissues and is exhaled. 
If done for long enough, the chances 
are greatly reduced that these gases 
will create harmful bubbles that 
can lodge in joints or travel in the 



Figure 20. Astronauts Steve Smith and Rex Walheim are suited up in the Equipment Lock during 
STS-110/ISS-8A. Walheim, on the right, already has a Mini-Workstation of tools installed on his 
chest. Jerry Ross, seen in the Crewlock in the background, helped as an intravehicular crew member 
for this EVA. 



Figure 21. The SAFER on the right is attached to the EMU before the crew gets into the Crewlock 
for airlock depress. A hand controller, similar to a joystick, stays tucked into a storage area. If a crew 
member needs to rescue himself or herself by flying back to the ISS structure, the hand controller can 
be removed from storage quickly. 
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bloodstream to critical organs, 
resulting in pain, severe medical 
issues, and even death. 

Multiple prebreathe protocols have 
been available and used on the Space 
Shuttle and the ISS. The various 
protocols can involve oxygen masks, 
exercise in the suit or on a bicycle 
machine, reduction in cabin pressure 
to 528 mm Hg (10.2 psi) (-equivalent 
to 3 km [10,000 ft] altitude) for a 
period of time, and/or prebreathe in 
the spacesuit. Prebreathe methods 
have evolved to incorporate 
reductions in crew day length and 
reduced complexity. For example, 
at one point, prebreathe (Figure 23) 
involved having the EVA crew 
sleep in the Joint Airlock overnight 
at a reduced cabin pressure; however, 
this had its pitfalls. In addition to 
sequestering the extravehicular 
crew members from their crewmates 
and the toilet, certain failures such 
Figure 22. SAFER installed during a test on Space Shuttle flight STS-64. as a fire alarm on the ISS will cause 

a repress of the airlock and will 
interrupt the prebreathe process. 

This can be frustrating when the 
alarm is false, as has happened in 
the past, since any interruptions in 
prebreathe protocol require strict 
penalties to “buy back” the time. 
Depending on the situation, the crew 
might have to breathe pure oxygen 
for twice the number of minutes than 
was the interruption. 

If a crew member exhibits DCS 
symptoms during an EVA, he or she 
will be brought inside as quickly as 
possible (with assistance from the 
other crew member, as required). The 
airlock will be repressurized, which 
immediately aids in recovery. The suit 

Figure 23. Astronaut Chris Cassidy is shown prior to an EVA during one portion of his prebreathe of 
pure oxygen to prevent DCS. In addition to an oxygen mask, he is wearing his LCVG, with small water- 
filled tubes throughout and larger ventilation ducts, as seen on his left arm and on his right waist. The 
Crewlock that goes to vacuum (located behind Cassidy) is filled with tools and storage bags. The suit 
umbilicals are attached to an umbilical interface panel in the Crewlock on one end and the EMUs on the 
other end. The EMUs are in the Equipment Lock in the foreground. One suit umbilical is routed under 
Cassidy’s arm and is connected to a suit, seen in the lower right corner of the photo. 
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Figure 24. The Crewlock is crowded with two crew members, tools, bags, and spare parts. Shirtsleeve crew members essentially stuff the crew in, with one 
crew member facing the hatch to be able to open it for egress to space and the other crew member facing a panel to operate the airlock. This is a photo of 
astronaut Rick Mastracchio (astronaut Clay Anderson’s feet are also shown) during STS-131/ISS-19A while the Space Shuttle was docked to the ISS. 


can also be pumped up to 413 mm Hg 
(8 psi) beyond the standard cabin 
pressure to help collapse bubbles in 
the crew member’s body. The flight 
surgeons in the control center will 
make medical recommendations 
while the EVA flight controllers work 
with the other crew members on the 
steps for installing and operating a 
device to allow the pressure of the 
suit to get this high. 

Quite a bit of overhead is involved 
in performing spacewalks 


(Figures 24 and 25), with more 
than 100 on-board crew hours 
logged before and after EVAs. 

Time is spent configuring the suits, 
preparing the tools with the exact 
complement needed (the astronaut 
cannot go back inside the ISS to 
grab a missing tool), studying the 
spacewalk (which may take place 
months after the last training run 
or is a contingency timeline that 
the crew never actually simulated), 
conducting refresher training on 
failures that could occur, discussing 


the robotics interaction with the EVA 
crew, and discussing the details with 
the ground team. The EVA flight 
control team will also collectively 
spend hundreds of hours planning 
and executing these activities. 

The Wall of EVA needed for ISS 
assembly required countless hours 
of preparations both on the ground 
and in space—and that was after all 
of the preflight ground testing and 
training. With the ISS in steady- 
state operations, science objectives 
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Figure 25. Astronaut Dan Tani is shown sleeping among the equipment between EVAs on STS- 120/ISS-10A. Notice the sign pointing into the airlock on the 
left. Some EMU equipment and unused EMUs are moved out from the larger part of the airlock where the crew suits up. 


compete with these EVA-related 
hours. Two or three EVAs are 
often grouped over the course of 
a couple of weeks, which reduces 
some of the overall number of hours 
spent. For example, if a suit will be 
reused by the same crew member 
on one increment, it doesn’t have 
to be resized. In addition, the crew 
members are more current on their 
training (e.g., SAFER flying, suit 
emergencies, no-touch areas of ISS 
due to sharp edges), making the 
process more efficient. 


Executing Extravehicular 
Activities: Managing 
the Risks 

EVAs are exciting and intense for 
the on-board crew and for the flight 
control team. The crew and the ISS 
are in a more-risky situation during a 
spacewalk, and the suit consumables 
are limited so time is of the essence. 
Crew members are exposed to the 
potential of DCS, a feeling of vertigo 
looking at the Earth, and extreme 
fatigue that could hinder their ability 


to get back to the airlock. The crew 
is less protected from MMOD than 
when inside the ISS, so there is a 
greater risk of MMOD penetrating 
the suit and injuring the crew 
member. Although crew training 
and good equipment should prevent 
a disconnect, a crew member may 
become untethered and have to use 
SAFER to fly back to the structure. 
Robotic arm maneuvers, while 
offering spectacular views, require 
EVA crew members to wedge their 
heels against the foot restraint to 
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keep from disengaging and floating 
away from the robotic arm. The crew 
members would remain attached 
to the ISS via their long retractable 
tethers, but this would be quite 
a debacle if a crew member was 
carrying a large piece of hardware. 

Risks to the ISS occur during 
EVAs due to the very nature of the 
human element and the potential 
for additional failures. A suit 
problem could force an EVA to be 
terminated (ended expeditiously) or 
aborted (ended extremely quickly 
in an emergency fashion to save a 
crew member’s life). For example, 
the control team terminated an 
EVA during STS-118/ISS-13A.1 
(2007) due to unexpected glove 
damage, and during US EVA 23 
(2013) when water entered a crew 
member’s helmet (see sidebar: US 
Extravehicular Activity 23 Water- 
in-Helmet Incident). In some cases, 
ending an EVA early could mean 
that bags or tethers block rotation 
of critical appendages such as the 
solar arrays or could block robotic 
movement. Also, if a large piece of 
the ISS is not tied down adequately 
with tethers, then it is possible that 
vehicles such as Soyuz could not 
dock or undock safely without the 
risk of having equipment fall off and 
impact other structures or vehicles. 

The EVA console in Mission Control 
Center (MCC) provides a status to 
the flight director and flight control 
team on the amount of consumables 
left in each EMU. The consumables 
include the oxygen quantity in the 
primary tanks, the capacity of the 
CCC in terms of ability to continue 
to remove carbon dioxide, water 
available for sublimator use, and 


battery power. The quantity of 
available oxygen is directly measured 
and sent to MCC in telemetry. The 
CCC does not put out telemetry of 
its capacity. This is derived based on 
how much oxygen a crew member 
is using, which is an indicator of 
his or her metabolic rate. From this 
metabolic rate over the course of the 
EVA, the team can determine the 
remaining CCC capacity based on the 
predicted capacity and subtracting 
out the already-used quantity. Water 
usage is not known until the reserve 
water comes on (automatically 
turned on due to reduced line 
pressure when the primary water is 
used up). In that case, the crew and 
ground will receive an alert that 30 
minutes remain, assuming a hole is 
not causing leakage, which would 
reduce the available time. Battery 
power is predicted and voltage can be 
measured for unexpected reduction in 
the remaining time available. 

The flight control team works to 
ensure the critical tasks get done 
while keeping an eye on consumables 
and crew health. Sometimes, 
predicting what the consumables will 
be is a challenge in this regard. For 
example, the limiting consumable 
(the one with the least amount 
of time remaining) is often the 
CCC. However, a crew member’s 
metabolic rate varies over the course 
of an EVA, with lower metabolic 
rates when on the Space Station 
Robotics Manipulator System. But 
high-effort tasks increase metabolic 
rate. Thus, determining whether 
a task is achievable in that EVA 
requires some predictive skills before 
an astronaut starts the task. Training 
runs in the NBL help establish trends 
for specific crew members. Oxygen 


can be recharged (refilled) by having 
the crew go into the airlock and 
connect to the umbilical, although 
this could significantly alter the 
choreography of the EVA. 

EVAs involve the human element 
both in space and on the ground. 
Crew member height and arm 
length can make a big difference 
in whether that crew member can 
perform a particular task. Mechanical 
aptitude is critical as well. The ISS 
needs someone who knows how 
to turn a wrench as much as they 
know science. Some complex tasks 
require very good back-and-forth 
communication between the crew 
and the ground, so language and 
patience are also factors. Assembly 
mission EVAs used the on-board 
crew (called “IV” for intravehicular) 
to read the instructions to EVA crew 
members and keep them on task; for 
standard increment operations EVAs, 
a “Ground IV” relays the details of 
each step from MCC. 

EVAs are physically demanding; 
therefore, crew fatigue is a major 
consideration during a spacewalk. 
Sometimes an EVA will go longer 
than planned because a task at the 
end of an EVA takes longer than 
anticipated due to crew member 
fatigue. Ground discussion among 
themselves and what information is 
exchanged with the crew on board is 
often key in decision making and the 
success of an EVA. 

Exposure to toxic chemicals during 
a spacewalk is another hazard that 
is carefully managed. The external 
coolant on the ISS is ammonia that, 
even in very small amounts, could 
be lethal if it gets stuck on the EMU 
or tools and the crew member brings 
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it back into the cabin. Several times, 
the spacewalking crew has been 
exposed to ammonia. The potential 
to bring ammonia back inside can 
be reduced by requiring the crew 
“bake out” before coming through 
the airlock (i.e., spend additional 
time outside to allow sublimation 
of the ammonia into vapor form, off 
the suit). If there is doubt that crew 
members might still have ammonia 
crystals on their suits, NASA may 
elect to have the crew use a piece of 
sampling equipment called a Draeger 
tube to test for the presence of 
ammonia. Partially repressed airlock 
air would mix with ammonia on the 
crew member’s suits and tools, and 
visibly turn reactant chemicals in the 
glass vial tube from yellow to blue. 

Equipment that is “dropped” 
overboard due to missing a tether 
connection or other problem is 
tracked by ground radar, if the item 
is big enough to be picked up on 
radar. However, there is potential 
for these objects to re-contact 
the ISS, contact another vehicle 
approaching or leaving the ISS, or 
in some cases survive reentry into 
Earth’s atmosphere and potentially 
harm people on the ground. Also, 
the now-missing equipment may be 
critical to the repair or task at hand, 
and the team will have to determine 
whether it can be accomplished on 
that EVA. Lost equipment in the past 
has included tools, a bag full of tools, 
and a camera. Occasionally, the ISS 
Program will approve an object to 
be dropped overboard intentionally 
as a jettison if it can be thrown in a 
particular direction and proven to 
result in extremely minimal risk to 
the ISS and people on the ground. 


The largest object ever jettisoned 
from the ISS was the Early Ammonia 
Servicer, a 544 kg (1,200 lb) tank of 
ammonia in 2007. 

The US Segment assembly of the ISS 
often involved robotic installation 
or partial installation of a major 
element when a Space Shuttle first 
arrived, followed by a series of three 
to four EVAs to structurally secure 
the element, hook up power and data 
connections, and perform related 
tasks. These EVAs were sometimes 
nail-biters, because a small issue had 
the ability to trip up the team and 
amount to an element freezing or 
the inability to fully safe the systems 
(Chapter 4). The mission time was 
limited and the Space Shuttle crew 
was specifically trained for some of 
the tasks, so changes to the EVAs 
during the docked Space Shuttle 
timeframe were often added into that 
short period with incredibly fast EVA 
development time. Over the years, 
many small issues (e.g., stuck bolt that 
would not release) as well as major 
issues (e.g., the entire tray of electrical 
and fluid lines that would not initially 
deploy while the equipment was 
waiting for power) were overcome by 
the crew and ground team to complete 
the mission at hand. 

Post-assembly, the intensity remains 
for many tasks, especially those 
that involve repair of a critical ISS 
systems unit. One example of critical 
EVAs to repair the ISS is the set of 
two EVAs that followed the external 
pump failure that occurred in 2013, 
which required the EVA team and 
crew to prepare and execute EVAs 
within a period of a couple of weeks. 
Further details of this situation are 
provided in Chapter 20. 


International Space Station 
Extravehicular Activities— 

A Benefit to Humanity 

This chapter was written as a general 
overview, but the real ISS hardware 
build-up for Space Station assembly 
transpired with extremely great 
detail at all steps along the way. 
Every part of the EMU is carefully 
maintained and rotated. Every 
aspect of every EVA is carefully 
planned (to the extent possible on 
Earth) and executed. The team of 
people involved is extensive, from 
the ISS hardware engineers to the 
suit engineers to the divers in the 
NBL—and the dedication to safety 
and great detail from everyone is 
awe-inspiring. 

Two chapters in this book 
(Chapters 18 and 20) highlight 
the critical role an EVA can have 
in keeping the ISS functioning. A 
peripheral benefit to the experience 
is also gained by building the ISS 
by hand. The intensity, quantity, 
and complexity of ISS EVAs could 
be considered a drop in the bucket 
compared to a program such as an 
exploration mission to Mars. The ISS 
provides many benefits to society. 
Through the ISS, NASA is learning 
ways to improve EVA efficiency, 
reduce overhead in preparations, and 
improve spacecraft design so that 
fewer failures occur. The training and 
experience gained in doing these low- 
Earth orbit EVAs will be invaluable 
for exploration of other worlds. 


SYSTEMS: EXTRAVEHICULAR ACTIVITIES-BUILDING A SPACE STATION 
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Chapter 18 Day in the Life: 

Risky and Rewarding 
Spacewalks— 

Space Shuttle Mission 
STS-120/ISS-10A 




Doug Wheelock and Scott Parazynski (in the spacesuits—left and right, respectively) are assisted in the airlock during Space Shuttle mission 
STS- 120/ISS-10A by European Space Agency astronaut Paolo Nespoli and International Space Station Commander Peggy Whitson. 


The International Space Station 
(ISS) Program always presents 
new and sometimes daunting 
Challenges . Each morning, the 
individuals working in Flight 
Operations never know whether 
the day might present one of the 
most critical problems in the history 
of the space station—whether the 
team will have to do something that 
has never been attempted. 

Scripting and training a spacewalk 
(i.e., extravehicular activity [EVA]) 
in advance is a major effort; however, 
the real-time execution of spacewalks 
usually requires deviating from the 
original plan. Problems with the 


ISS systems that require an EVA 
fix can arise, tasks may take longer 
than expected, or a spacesuit issue 
might end an EVA early. Quick- 
decision moments are fairly common. 
Spacewalks are physically rigorous. 
The “human-in-the-loop”—both 
in space and on the ground—often 
necessitates flexibility. None of the 
space station parts were ever able 
to be tested preflight by a suited 
crew member in space-like thermal, 
zero-g, and vacuum conditions. 

When these factors come together in 
space, problems such as stuck bolts 
or problematic hinges can occur. The 
critical decisions made in the midst of 
never-before-seen technical or human 


problems during EVAs intensely draw 
upon the Foundations of Mission 
Control (see Introduction). 

Take one Space Shuttle mission 
to the ISS, as an example. Space 
Transportation System (STS)-120/ 
ISS-10A launched late in October 
2007. Despite extensive EVA 
choreography preparations for the 
mission objectives, the planned 
spacewalks changed dramatically 
once the mission was under way. This 
chapter discusses the work that was 
done preflight and how it changed— 
not once, but multiple times—as the 
flight control team adapted to an ever- 
changing situation. 
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The Original Mission 

One of the top objectives for 
STS-120 was to deliver the 
pressurized module called Node 2 
by robotically removing it from the 
Space Shuttle cargo bay and installing 
it on a temporary location on Node 1. 
The Node 2 module was a critical 
element in that the European Space 
Agency (ESA) and Japan Aerospace 
Exploration Agency modules would 
attach to it, making way for new 
countries to have permanent presence 


on the ISS after the many years they 
spent building their respective part 
of the station on the ground. The 
10A mission and subsequent stage 
operations to move Node 2 to the 
forward position had to be completed 
prior to the much-anticipated shuttle 
mission carrying the ESA Columbus 
module, which was due to launch in 
December 2007. 

Another key assembly objective 
was the transfer (relocation) of truss 
segment P6 from the central zenith 
(i.e., upper) part of the ISS, where 


it had temporarily been placed for 
7 years, to its final assembly-complete 
location at the far-port end of the truss 
(Figure 1). Prior to this mission, the 
large P6 solar array blankets had to 
be retracted (i.e., folded, accordion- 
style) so they would not sway or flap 
and possibly break when P6 was 
moved to the port side. During the 
STS-120 mission, the team would 
perform the robotic transfer and EVA 
bolting of P6 (Figure 2) onto the end, 
followed by commanding re-deploy 
of the arrays (Figure 3). 



Figure 1. The ISS as seen from the Space Shuttle as it departed during STS-118, the mission immediately prior to STS-120. P6 is located in the center of 
the truss, with its solar arrays folded up in the long blanket boxes (as shown in the inset photo). 
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Figure 2. Graphic of the installation of the P6 module onto P5 during STS- 120/ISS-10A. The solar arrays are folded up, accordion-style, in the long blanket 
boxes that are protruding from the cylindrical mast canister. Left image shows the P6 being maneuvered into position, whereas the right image shows it just 
prior to mating. Graphic generated using Johnson Space Center’s Virtual Reality Laboratory software. 


Mobile Transporter, 
Base System, and 
Robotic Arm. 


Furthest point to port 
side to which the Mobile 
Transporter can travel. 


P6 in final location. 
These two blankets are 
together called “4B.” 



These two blankets 


are together 
called “2B.” 


Figure 3. The huge solar arrays give the ISS an impressive wingspan, as seen here overlaid on an American football field. The Mobile Transporter is 
constrained to the middle truss sections by the large rotating Solar Array Alpha Joints. After the P6 truss module relocation to the far-port end of the ISS, 
the arrays are not accessible by an EVA crew member standing on the robotic arm due to the Mobile Transporter limitations. This lack of reach created a 
challenging circumstance during the STS-120 mission. 
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Original Pre-Mission 
Spacewalk Planning 

Most of the United States On-orbit 
Segment EVAs that occurred during 
ISS assembly were planned to occur 
during shuttle missions using shuttle 
crews, despite the fact that qualified 
spacewalking ISS crew members 
were constantly manning the ISS. 
This occurred for several reasons. 
First, the shuttle launched new ISS 
elements and pieces of hardware that 
usually needed specialized training 
for assembly or deploy choreography, 
and crews had to dedicate a lot of 


time to study for some assembly 
EVAs. Training time was not as 
available for ISS crew members 
since they had an extensive multiyear 
training plan just to learn how to 
run the day-to-day operations on the 
ISS. This training included Russian 
language study and extensive 
international travel. Furthermore, 

ISS crew members were often 
committed to launching in a Russian 
Soyuz vehicle, and the Soyuz 
launch schedules were not typically 
tied directly to the shuttle launch 
schedule. In some cases, ISS crew 
members had used precious time to 


train for shuttle-present EVAs, only 
to see shuttle missions moved out of 
their Expedition due to launch slips. 
As a result, assembly EVAs were 
assigned to shuttle crew members 
that would launch with the new 
elements. Shuttle crews performing 
these EVAs could dedicate a large 
amount of time training for EVAs, 
which meant greater efficiency 
during the tasks—e.g., less time 
was spent in space discussing the 
preferred location for a tether since 
crew members had already tried out 
a few locations while in training and 
decided upon the best approach. 



Figure 4. The crew on orbit in the ISS during STS-120/ISS-10A: Top row: (left to right) Dan Tani, (extravehicular [E\f] number 3, EV-3), Scott Parazynski 
(EV-1), Doug Wheelock (EV-2). Middle row: (left to right) Stephanie Wilson (robotic arm operator), Pam Melroy (shuttle commander and robotic arm operator), 
Paolo Nespoli (primary intravehicular (IV) crew member that aids the EVA crew during suit-up and the EVA). Bottom row: (left to right) Clay Anderson (ISS crew 
member), Peggy Whitson, (ISS commander, EV-4), Yuri Malenchenko (cosmonaut, EV-5), George Zamka, (robotic arm operator). 
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For these reasons, the STS-120 
mission was initially planned with 
three spacewalks to be performed 
by crew members coming up in the 
shuttle (Figure 4). 

■ EVA 1. The first EVA was required 
to disconnect and prepare Node 2 
so it could be robotically unberthed 
from the shuttle cargo bay using the 
Space Station Robotic Manipulator 
System. Also, the first of the truss 
element P6 connections were to 

be demated to allow for its later 
release from the central truss 
element Zl. Shuttle astronauts 
Scott Parazynski and Doug 
Wheelock (nickname “Wheels”) 
were trained to perform this EVA. 

■ EVA 2. The second EVA was 
needed to release the remaining 
connections and bolts for a final 
disconnect of P6 from Zl. This EVA 
was also needed to install critical 
exterior parts onto the outside of 
Node 2 before the operations in the 
stage and next shuttle missions. 
Parazynski and Dan Tani were 
trained to perform this EVA. 
Between EVAs 2 and 3, extensive 
robotic operations were needed to 
move the P6 segment close to its 
final location on the P5 truss. 

■ EVA 3. The third EVA was needed 
to align, bolt, and connect up P6 
as well as ready a radiator for 
deploy. At the end of the third 
EVA, while the EVA crew was still 
outside, Mission Control Center- 
Houston would start deploying the 
radiator and P6 solar arrays 2B 
and 4B to begin generating power 
for ISS use. Shuttle astronauts 
Parazynski and Wheelock were 
trained to perform this EVA. 


Several secondary objectives were 
included with the three EVAs. 

One task was to remove a failed 
antenna called the S-band Antenna 
Support Assembly, which weighed 
103 kg (228 lbs), from the ISS and 
install the antenna in the shuttle cargo 
bay for return to the ground. The 
crew also took a new spare power 
distribution unit called a Main Bus 
Switching Unit, which is 238 kg 
(525 lbs), out of the cargo bay and 
placed it near the ISS airlock to be 
used in case of future failures of this 
type of unit. These operations and 
other tasks were built in as part of 
the three EVAs. 

Originally, three other ISS EVAs 
were planned after the STS-120 
mission. These EVAs were needed 
for the Node 2 move to its final 
location on the forward end of the 
laboratory. The ISS crew had been 
training for these “stage” (i.e., 
shuttle not present) EVAs. See the 
Introduction for more details about 
stage EVAs. 


Last-minute Spacewalks 
Added to the Mission 
Preflight 

After the STS-120 mission was 
initially planned, the shuttle orbiters 
were changed from Atlantis to 
Discovery due to a delay in preparing 
Atlantis for flight. Discovery had 
been outfitted with the capability 
to draw power from the ISS after 
docking, thus the mission could 
be extended and the number of 
EVAs to be performed during the 
mission could be increased. EVAs 
during shuttle docked mission 
were advantageous because the 


combined number of crew members 
on board would be 10 (seven shuttle, 
three ISS); therefore, more crew 
hours would be available to get 
the spacewalkers ready. The same 
strategy is discussed in Chapter 4 
with respect to STS-130/ISS-20A. 

As a result, in the spring of 2007, a 
pre-planned stage EVA by the ISS 
crew was moved into the shuttle 
docked time frame to bring the total 
number of EVAs during the mission 
to four. Two already-trained ISS 
crew members (Peggy Whitson and 
Yuri Malenchenko) would conduct 
this EVA. They would perform 
the EVA while the shuttle was 
present instead of after the shuttle 
departed. The team knew that if 
high-priority EVA tasks went long 
or new tasks were required during 
the shuttle docked time frame, the 
fourth planned spacewalk could be 
deferred until after shuttle departure. 
Whitson and Malenchenko, along 
with the required tools, would still 
be on board. The main purpose of 
this EVA was to get a step closer 
to the Columbus module mission 
by prepping for a robotic transfer 
of Pressurized Mating Adapter 2 to 
Node 2 and the eventual relocation 
of Node 2. The EVA crew would be 
demating connectors between the 
Pressurized Mating Adapter and the 
Laboratory, and removing a cover 
from Node 2. 

After this change, and about a month 
prior to the flight, another spacewalk 
was developed and added to the 
mission in unusually quick fashion. 
This EVA was to be performed by 
Parazynski and Wheelock to test some 
material that could repair the Space 
Shuttle orbiter tiles, if damaged. Ever 
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since the Columbia accident in 2003, 
NASA had worked hard to develop a 
method to repair the delicate heat- 
dissipating tiles that protected the 
orbiter during reentry into the Earth’s 
atmosphere. (This was in addition 
to wing leading edge repairs, which 
required different materials.) The 
tile repair material was a consistency 
somewhere between peanut butter 
and toothpaste. The crew would apply 
the repair material to damaged tiles, 
and the material would harden to 
the firmness of a pencil eraser and 
insulate (via specifically formulated 
properties) the orbiter during its 
super-heated reentry. This material 
was squirted out of a container called 
the Tile Repair Ablator Dispenser 
(T-RAD). The new EVA was labeled 
the T-RAD Detailed Test Objective. 

Most EVAs are planned, preflight, 
over the course of months or even 
years; however, the operations 
team was asked to quickly finalize 
a tile repair test procedure because 
of the criticality of the test and the 
familiarity of the team and crew 
with the tile repair testing. A debris 
strike had damaged a tile during 
the STS-118/ISS-13A.1 mission 
that flew in August 2007. The level 
of speculation about tile repair 
capability prompted Space Shuttle 
Program management to conduct an 
official test as soon as possible. The 
team was able to develop this EVA 
within a few short weeks using some 
already-developed techniques that 
were familiar to the crew. Parazynski 
happened to be on the EVA 
Thermal Protection System repair 
collaborative team, as was the STS- 
120 lead EVA officer Dina Contella. 
Putting the experiment on this flight 
with quick turnaround was acceptable 


for the STS-120 operations team in 
terms of the limited training required. 
In fact, it seemed serendipitous that 
the team that worked so hard on 
creating this capability would get to 
execute the on-orbit test. 

The team agreed to insert the tile 
repair test spacewalk after P6 
installation (EVA 3) and before the 
increment crew Node 2 EVA. As 
discussed in Chapter 4, long missions 
with a number of spacewalks can be 
very tiring to the crew. This Detailed 
Test Objective EVA would be shorter 
than usual (4 hours) to better allow 
for spacewalks on back-to-back days 
without exhausting the crew. 

When Discovery lifted off on 
October 23, 2007, the spacewalks 
had evolved from the original 
three planned EVAs to five EVAs. 

It was to be the first ISS docked 
mission with five planned EVAs and 
the first mission with five different 
EVA crew members. 


Flight Days 1 -3 (Tuesday, 
October 23 through 
Thursday, October 25) 

STS-120 launched on Tuesday, 
October 23, 2007. The mission 
proceeded with a normal early mission 
timeline, including checkout of the 
spacesuits on October 24 (Flight 
Day 2). On October 25, the day the 
shuttle was performing a rendezvous 
with the ISS, the operations team 
was approached about adding a new 
EVA task to the mission to have 
the crew look at the starboard Solar 
Array Rotary Joint (SARJ) (Figure 5). 
This huge round gear measures 4 m 
(13 ft) in diameter and is driven by 
a motor to enable the solar arrays on 
the end of the truss to track the sun 
via rotation of the entire end of the 
truss. The engineering community had 
seen some slightly increased currents 
(-0.1 amp, with intermittent changes 
up to 0.8 amp) associated with the 
motor. Video indicated that the arrays 



Figure 5. S3 SARJ (circled) rotates the outboard segments to point the solar arrays at the sun. The 
EVA crew was tasked with inspecting this SARJ to determine the source of increased motor current. 
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What You Will See With MLI Cover Removed 



Outboard Race Ring 


Inboard Race Ring 


If MLI Cover is 


removed, race rings 
(2), trundle bearing 
assembly (TBA) and 
SARJ ring structure 
are visible. 


• Inspect all hardware 
for scoring, damage 
or foreign object debris 


• Inspect race rings for 
missing/damaged teeth 


Race Ring Gear 
Teeth - inspect for 
visible damage and 
foreign object debris 


Trundle Bearing Assy 


P3 SARJ with All MLI Covers Removed 


Figure 6. Instructional information that the Mission Control team sent up to the crew members to 
study before they performed an EVA to inspect the S3 SARJ. This SARJ hardware would be seen under 
the white multilayer insulation (MLI). Photo credit NASA-JSC/John Ray taken at the Kennedy Space 
Center prior to S3 launch. 


sometimes shook, as if there was 
increased friction somewhere on the 
circular travel surface or in a drive 
mechanism. It was speculated that 
this could be caused by a piece of 
thermal blanket that was dragging, 
the presence of foreign object debris 
(i.e., something that is not supposed 
to be there such as a piece of wire or 
washer), or something misaligned 
in one of two drive lock assemblies 
that houses the motor and lockdown 
mechanism. The starboard rotary joint 
had been on orbit a significantly less 
amount of time than the port side, 
which did not show any increased 
current; thus, age was not causing the 
starboard side to degrade. 


The biggest concern was that 
friction would eventually increase 
to the point that either the motor 
couldn’t overcome the force or the 
motor would fail, resulting in the 
inability to position the solar arrays. 
In addition to needing good array 
pointing to generate enough power, 
the arrays needed to be pointing 
in “safe” directions so they could 
endure the shaking and jet forces 
from visiting vehicle dockings 
and undockings (see Chapter 9). 

In fact, to ensure the arrays would 
be pointed in a good direction for 
the docking of Discovery, the team 
had preemptively “parked” (i.e., 
stopped rotation of) the starboard 
SARJ before the mission with the 


arrays aligned in a position that 
would allow for the docking and also 
have adequate power generation for 
that time of year while minimizing 
potential wear and tear. 

After so much speculation about 
what could be causing the SARJ 
issue, the engineering team wanted 
to have the EVA crew look at it. 

The flight control team worked 
with the SARJ hardware experts 
on an external inspection plan 
(Figure 6) and the removal of at least 
one protective panel to get a good 
look at the rolling surface and gears. 
Space Station Program management 
initially requested this to be a task for 
a later spacewalk, but the EVA team 
identified a good time frame in the 
middle of EVA 2, requiring deferral 
of only one lower-priority task to a 
later EVA. The flight control team 
was already adapting to the changing 
needs of the flight. 

Flight Days 4-5 
(Friday, October 26 and 
Saturday, October 27) 

EVA 1 was executed as planned. 

EVA crew members encountered 
relatively minor anomalies; e.g., 
some bolts were sticky (i.e., difficult 
to remove) and some ammonia ice 
flakes had floated out during the 
initial crew disconnection of PI from 
Zl. As discussed in Chapters 4 and 
17, the ground team had to track that 
the crew spent enough time baking 
out (i.e., allowing the ammonia to 
sublimate off of the suit) and had the 
crew members perform a test in the 
airlock to verify the absence of toxic 
quantities on their suits, which could 
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contaminate the ISS atmosphere. 

The Node 2 module was robotically 
moved out of the shuttle payload bay 
to its temporary location on the port 
side of Node 1. Applause erupted 
in the engineering room over this 
important new module for the ISS. 

The day between EVAs 1 and 2 was 
spent preparing the suits and tools 
for the next EVA. This day also 
allowed time for the flight control 
team to get information to the crew 
members about their new task to 
inspect the SARJ and for the crew 
members to study the slightly altered 
choreography for the EVA. 


Figure 7. Photos of tape that the EVA 2 crew used to pick up metal particles seen on the SARJ. The 
tape was initially adhered to a caddy (top photo) that resembled a book with slick paper. The crew 
peeled the tape off of the caddy and made a loop with the sticky side out to pat the area and pick up the 
particles (bottom photo). The tape was put into a bag that came back down to the ground on the shuttle. 


Flight Days 6-7 
(Sunday, October 28 and 
Monday, October 29) 

The flight control team had its hands 
full of small EVA surprises during 
the second spacewalk on October 28. 
Detaching the P6 truss segment 
went well, but some of the shorter 
planned tasks had to be cancelled 
(i.e., put into later EVAs) due to 
the issues encountered throughout 
the day. For example, the display 
locked up on Tani’s spacesuit, and 
he had to perform a “reboot,” as one 
would with a locked-up computer 
display. Also, the crew had difficulty 
operating some of the connectors, 
small o-rings floated out of some of 
the connectors, and a pin dislodged 
and couldn’t be extracted from an 
area at a Node 2 berthing mechanism. 

The starboard SARJ inspection 
revealed major news that would 
heavily affect the next few days. 
When Tani removed the cover, he 
saw what appeared to be magnetized 


metal shavings on the passive ring 
of the SARJ (Figure 7). Shavings 
indicated pieces of the joint were 
grinding so hard that small metal 
pieces, also known as Foreign 


Object Debris, were coming off and 
creating some amount of permanent 
damage. Tani’s electronic still 
camera was not working, so the 
ground sent Parazynski to retrieve 
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a spare camera; however, that one 
did not work either! The live video 
from Tani’s helmet camera was not 
detailed, but it was the best footage 
the ground team was going to get 
that day. The team had Parazynski 
gather a pouch with some adhesive 
tape while at the airlock. The crew 
was able to use the tape to pick up 
shaving samples by touching the 
adhesive side to the shavings. These 
could not be analyzed until they 
were brought home after the mission, 
but they would eventually allow 
the engineering team to identify the 
source of the material. 

Before EVA 2 was even over, the 
operations and engineering teams 
were already thinking about what 
they could accomplish during this 
mission to continue searching for the 
root cause of the issue. Although the 
starboard SARJ could be positioned 
for this particular mission, analysis 
had not yet been completed to show 
there were adequate SARJ angles 
obtainable for the stage time frame 
after Discovery left and during 
the next shuttle mission that was 
planned for a few weeks later. The 
next mission would bring up the 
first ESA module: Columbus. Due 
to undesirable sun angles (called 
a “beta cutout,” as discussed in 
Chapter 9) starting mid-December, 
having to add EVAs to the stage 
before that mission would likely 
push the Columbus launch 
significantly until after the sun 
angles became more favorable for 
both spacewalks and dockings. 

A group called Team 4 was formed 
(see also Chapter 20) after EVA 2. 
Led by a flight director, Team 4 was 
tasked to assess whether it would 
be possible for the EVA crew to 


remove the 22 thermal covers that 
protected the SARJ and perform 
a detailed inspection of the entire 
SARJ to find the culprit hardware 
interference scraping the SARJ. This 
effort involved experts from across 
the country who were associated 
with the design and function of the 
SARJ, many of whom were also 
the solar array experts. The team 
quickly realized an inspection of 
this magnitude would take an entire 
EVA since the covers were bolted 
on and unbolting takes time. Team 4 
started working around the clock 
on new SARJ inspection spacewalk 
procedures. The console team worked 
the overall plan to incorporate this 
EVA into the mission. 

EVA 3 had to continue as planned 
on Flight Day 8 with the P6 segment 
released from the Z1 section and 
needing to be bolted onto the port 
end of the truss. The new SARJ 
spacewalk would have to take 
the place of either the tile repair 
experiment on EVA 4 or the stage 
EVA 5. This was an interesting 
trade because the Space Shuttle 
Program was highly motivated to 
complete the tile repair experiment 
that required shuttle hardware/ 
tools, and which was to be stowed 
in the payload bay for return. The 
ISS Program needed to complete 
the high-priority stage tasks before 
the December launch of Columbus; 
otherwise, Node 2 would not be in 
the right place for the Columbus 
attachment. In the end, this interim 
debate was superfluous. None of 
these three EVAs (SARJ, tile, or 
stage) would occur during STS-120. 
The mission was about to encounter 
a major setback. 


Flight Days 8-9 
(Tuesday, October 30 and 
Wednesday, October 31) 

The EVA crew bolted on the P6 
truss during EVA 3. The ground 
commanded the P6 arrays to slowly 
unfurl (i.e., deploy) from their folded- 
up condition (see Chapter 9) in a 
manner fairly similar to what had 
been done 7 years earlier on STS-97/ 
ISS-4A. An array deploys via motor 
in the central mast, which lifts the top 
half of a blanket box, resulting in the 
unfolding of the arrays. This re-deploy 
was to be done during orbital day so 
that crew members could directly 
watch and command an abort if they 
saw that the array was not deploying 
nominally. Going into the mission, 
the team thought P6 deploy might 
be tricky since other array deploys 
had required real-time procedural 
changes or even EVA assistance in 
the past. The day after EVA 3 was 
planned as somewhat light to enable 
the team to work on slower or fancier 
deploy methods if needed, based on 
what the team saw during the initial 
deploy attempt of the P6 arrays. What 
actually happened was jaw-dropping, 
and completely unforeseen. 

The 2B side managed to deploy 
without issues, but the team was 
able to deploy the 4B array only 
approximately 80% before a 0.6- to 
0.9-m (2- to 3-ft) tear developed. 
Video showed that the array was torn 
along an accordion hinge line. Closer 
inspection revealed a smaller tear and 
a tangle in the guidewire that should 
have been assisting a smooth deploy 
(Figure 8). The flight control team 
sent a command to slowly retract the 
array just enough to relieve some 
tension so that the tear would not get 
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Figure 8. The 4B array damage. The crew and 
ground team aborted the deploy operation when 
the tear was noticed, thus the array did not get 
to the end of the deploy sequence where it would 
have been pulled taut. 


worse. While the array was parked in 
this partially deployed state, the flight 
control team tried to determine what 
to do next. 

After looking at the video, it seemed 
clear the array could tear more if 
loads (i.e., forces) were put into 
it. One major concern was that 
vibrations and jet firings during the 
shuttle undocking or other visiting 
vehicles coming/going could cause 
the array to sway and rip further. It 
might not be repairable if it worsened. 
Further damage could lead to a need 
for the array to be jettisoned, meaning 
a future crew would have to dismantle 
it at the base and push the array to 
bum up into the atmosphere. This 
would present an extremely complex 
operation in which a jettison would 
leave the ISS with much-reduced 
power. Building another array would 
be costly. Future concerns aside, the 
near-term reality was that a ripped 
array could flap around and cause 
major damage to other components. 


This issue became the top problem to 
solve on this mission. 

Solar array retractions and deploys in 
the past had sometimes required EVA 
crew assistance, as the mechanisms 
to unfurl large blankets of solar cells 
are fairly complex. The blankets 
are huge, with each array “wing” 
composed of two blankets—each 
approximately 35 m (115 ft) tall. 

The blankets were originally folded 
up in an accordion fashion inside 
a blanket box that was only 0.5 m 
(20 in.) tall. Often, a fold would 
stick to an adjacent fold when the 
blankets were later stretched out 
(Figures 9-11), or some part of the 
delicate mechanism would need the 
ground team’s creativity to jostle or 
pull it, or it would need an EVA crew 
member to carefully expand the array. 
The P6 arrays were not expected to be 
sticky since they had been deployed 
previously; however, the EVA crew 
had been trained, pre-mission, to 
handle other potential array issues 



Blanket Box 
upper half % 
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(15.0 ft) 


Solar Array 
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Figure 9. Solar Array 
Wing. Each array blanket 
was originally folded up, 
accordion-style, into a 
box. When the arrays were 
deployed, the boxes were 
commanded to unlatch, 
and the center mast that 
was folded up inside a 
canister was commanded 
to elongate. This effectively 
pulled the top half of the 
box (attached to the blanket) 
away from the bottom half 
of the box (attached to the 
other end of the blanket) and 
stretched out the folds in 
the blankets. (ISS Electrical 
Power Systems Training 
Manual - 01.04.05(0)T0005, 
Version 1.0, (supersedes 
TD9707)) 
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Figure 10. A solar array blanket located in a ground facility. It is 
shown still mostly folded up in the lower half of the blanket box, as 
if the ground had just started to command a deployment. The active 
side of the array (shown) is where the solar cells (gray) are located 
to gather energy from the sun. 



Figure 11. Passive side of the array (solar cells are on the other side of the array). 
The blankets are hinged. When they deploy small grommets move up the guidewire. 
The guidewire keeps the blankets from swaying and bowing too much when the 
array is fully deployed. 


such as freeing up small snags along 
the guidewires that help keep the 
array straight (Figures 11-12). 

Team 4 and the console team were 
still working on the SARJ inspection 
EVA but had to start reprioritizing an 
array repair in short order. On Flight 
Day 9, the team decided to change 
EVA 4 from the SARJ EVA to a 
solar array repair EVA. Parazynski 
and Wheelock were chosen to 
perform the spacewalk, with 
Parazynski performing the repair 
since he was the most experienced 
EVA crew member on board. 


The Challenges 

Repair of the array would be a high- 
degree-of-difficulty spacewalk if 
a fix was even possible. The flight 
control team did not have much 
time to create and execute such 
an EVA before the shuttle had to 
undock. Under the direction of the 
Team 4 flight director, multiple 
flight control and engineering 
teams—EVA, robotics, and power, 
to name a few—worked around the 
clock to identify each roadblock and 
devise a fix. Below are some of the 
challenges that the ground team and 
crew faced going into the EVA. 


1. The Damage Might Be 
Just Out of Reach 

The solar arrays were far, far away 
from the crew modules. P6 was no 
longer in the center of the truss as it 
was at the beginning of the mission. 
The most obvious technical issue was 
going to be reaching the damage. The 
snag could not be reached by an EVA 
crew member on the robotic arm, 
even with the arm fully outstretched. 
The team looked at the potential for 
retracting the array so the damage 
was near the base, but it was too 
risky to move the array that much. 
The damage could get worse, and 
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the accordion aspect could not be 
expected to work correctly. 

However, the Space Shuttle had 
a long 15 m (49.2 ft) boom called 
the Orbiter Boom Sensor System 
(OBSS) that the shuttle had been 
flying since the Columbia accident. 
The purpose of the OBSS was for 
up-close inspection of damage on 
the underside and wings of the 
orbiter. A shuttle EVA crew member 
could stand on the tip of the boom 
while the boom was grasped by 
a robotic arm to perform a repair. 

Use of the boom grasped by the 
ISS robotic arm (17.6 m [57.7 ft]) 
looked feasible for reaching the array 
damage—albeit barely—according 
to virtual reality and software models 
of the ISS. The ground team used 
this as the concept for the EVA. 


The ground team set up the robotic 
systems ahead of the EVA, optimistic 
that the computer models were 
accurate in their conclusion that 
Parazynski could reach the array 
damage site. The team prepared 
for the EVA by translating the 
Mobile Transporter with the ISS 
robotic arm on it from the end of the 
truss to the center of the ISS. The 
SSRMS was now ready to take the 
OBSS out of the Discovery cargo 
bay. When the time came, the ISS 
arm would grasp the boom and the 
Mobile Transporter would move 
back to the end of the truss to point 
the tip of the boom toward the truss 
structure so that Parazynski could 
put his feet in a restraint at the tip 
for the ride out to the array. These 
complicated robotics operations 
were not pre-planned. A fairly large 


effort was required to develop the 
procedures and perform the analysis 
to ensure the operation was safe. 

2. The Damage Was Not 
Well Understood 

Even with the most powerful zoom 
lenses, the damaged portion of the 
array was too far away from the crew 
inside the Space Shuttle and the ISS 
for a detailed look at the problem. 
Using the best crew-taken photos, the 
flight control team tried to map out 
the damage to the extent possible to 
develop a good repair (Figure 12). In 
the end, there were some “if you see 
this then do that” steps in the crew 
repair procedures on the day they 
performed the EVA. As always, the 
flight control team tried to prepare for 
every imaginable scenario. 
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Figure 12. 

This was the best 
close-up photo of the 
damage available in 
the days prior to the 
EVA. The ground team 
marked it up with 
white lines and red 
markings, as shown, 
and uplinked it to the 
crew in this training 
documentation. 
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3. Repair Materials Had To 
Be Crafted On Orbit 

The solar array specialists, structural 
loads analysts, EVA team, and the 
crew’s maintenance instructors tried 
to find any available materials on 
orbit that could clear a snarl of wires 
and permanently sew together the 
panels that had come apart at the 
hinges. Clearing or cutting the snag 
could likely be done using available 
US and Russian EVA tools; however, 
EVA tools would not do the trick for 
repairing the hinges. 

Looking back, this effort was similar 
to the famous scene in the movie 
Apollo 13 when ground controllers 
had to figure out how to build a 
carbon dioxide filter out of parts 
available to the crew. Using array 
parts on the ground and gathering a 
pile of various materials available 
inside the ISS, the flight control and 
engineering team came up with an 
ingenious solution. Special straps 
that could hold the panels together 
were proposed, taking advantage 
of intentionally designed holes on 
each side of the hinges (a thick pin 
was inserted into these holes to 
stabilize the arrays for launch, but the 
holes were not used after a standard 
array deploy). Five straps of three 
different lengths—89 to 165 cm 
(35 to 65 in.)—would hold the panels 
together the way tuxedo cufflinks 
work. Each end fed through a hole 
on opposite sides of the separated 
hinge lines. Crew members had 
to manufacture the straps out of a 
sheet of aluminum, some wire, and 
some tape. They cut the aluminum 
into 10 cm (4 in.) long and 2 cm 
(0.75 in.) wide strips, punched holes 
in the aluminum using a hand punch, 
created the specific length needed 
using 12-gauge wire, made an EVA 



Launch pin holes that 
are not used after the 
array comes out of its 
blanket box. These 
were used as attach 
locations for the 
straps holding the 
array panels together. 


that would hold 
the panels 
together despite 
the damage 


Figure 13. Hardware engineers and analysts discuss the repair during STS- 120/ISS-10A while 
looking at the solar array ground unit. This photo provides some scale, when the array is compared 
to a human. A full Solar Array Wing would measure 35 m (115 ft) in length. 


tether point, and wrapped everything 
in tape (see Chapter 16). The 
developed technique was then tested 
on the ground (Figures 13 and 14). 
The cufflink that was produced on 
orbit is shown in Figure 15. 

4. Electric Shock and 
Sharp Edges Hazards 

One of the most challenging aspects 
involved the safety of a spacewalking 
crew member working around 
the solar array. Unlike Orbital 
Replacement Units, which were 
discussed in the Introduction and 
Chapter 16, the arrays were not 
meant to be repaired by an EVA 
crew member. These arrays have 
sharp areas, which could puncture 
or cut the spacesuit. Plus, in this 
case, there were a lot of “unknowns” 
about the damage and what could 


be sharp in that snag point. Most 
significantly, a solar array carries 
enough electric charge to electrocute 
the crew member in the spacesuit. 
Team members had to methodically 
think of everything that could lead to 
an electric current getting to the crew 
member, and to keep those scenarios 
from happening. The electrical 
power systems flight controller can 
reconfigure the electrical power 
system to reject energy from some 
areas, but no one can prevent the solar 
cells from becoming energized. 

The concerns were numerous 
regarding the electrical aspect. 

Could crew members actually be 
electrocuted if they touched the 
damaged area? Could metal parts 
heat up and turn molten, such that 
a drop could come off and burn 
a hole in the spacesuit? Could 
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Figure 14. Repair technique development during STS-120/ISS-10A. Hinge stabilizing wires were 
called cufflinks because the crew would insert a thin 10 cm (4 in.) long aluminum plate through a hole, 
where it would catch on the other side. This plate was attached via a long wire to another plate that 
the crew would also thread through the array and into a hole on the other side of the damaged hinge. 
The first two figures show the insertion technique. The third photo shows the backside, where the wire 
is not visible but the aluminum plates are seen flat against the array. In the last photo, astronaut Steve 
Swanson tries out the technique while wearing an EVA glove to test whether Parazynski will be able to 
perform the technique while suited in the Extravehicular Mobility Unit. 



Figure 15. STS-120 pilot George Zamka holds 
up a cufflink that he and ISS Commander Peggy 
Whitson constructed on orbit in preparation for 
the 4B solar repair EVA. 

sparking/arcing occur and jump 
between the array and tools or the 
suit? Could the energized “plasma” 
environment of the ISS in its orbit 
aid in this arcing? Was there a better 
time to perform the repair relative 
to orbital sunrise/sunset to reduce 
the risk of shock—and how does 
wait time in the orbit trade against 
the risk of having Parazynski 
remain near the array while waiting 
for the perfect conditions? 

Because sunlight reflects off of the 
Earth and the ISS, the array could be 
energized even during orbital night. 
The team quickly decided the crew 
would only work from the passive 
side of the array (solar cells facing 
away from the crew). That did not 
avoid the danger completely—the 
array damage could still point part 
of a cell toward the crew member, 
exposing him to an electric charge. 
Parazynski’s huge suit or his floating 
tools might accidentally come in 
contact with the damage, especially 
if the array was swaying while he 
attempted to enact the repair. The 
team could imagine having him cut 
a wire and releasing some stored 
energy that would “twang” or 
oscillate and move the array. 
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Various experts on electrical shock 
and plasma weighed in. The EVA 
console brought in safety experts to 
brief the EVA team on the hazard and 
how to prevent it. They were told 
the path to shocking the crew could 
be as follows: a hot (i.e., electrically 
energized) part of the array comes 
in contact with a metal tool, the tool 
touches a metal part of the suit such 
as the hard wrist connection, the 
astronaut touches the same part on 
the inside of the suit and is sweaty, 
another sweaty body part touches 
another metal part of the suit such as 
the waist bearing, and that metal part 
touches a grounded part of the array 
such as a guidewire. This scenario 
would result in an electric current 
traveling through the astronaut’s 
body. The EVA team relayed this 
information to the crew, via private 
video conference, to make sure 
everyone understood the hazards. 

The team went about ensuring 
this chain of events would not be 
possible. Parts of the suit and the 
tools were taped with insulating 
Kapton orange tape. The tape would 
keep electric charge from conducting 
between the array and the tool. Also, 
the ground had the crew tape up the 
metal wrist area of the Extravehicular 
Mobility Unit where the gloves 
attached. The number of tools 
Parazynski had with him was kept 
to a bare minimum, which provided 
a better chance of preventing tools 
from floating into the array. 

One question was whether sparks 
could jump through space, similar 
to lightning, if electrical charge 
differences were present. Although 
there is very little atmosphere at the 
altitude of the space station, charged 
particles surround the Earth. Plasma 
Contactor Units on board the ISS 
are turned on for spacewalks to 


specifically emit electrons into space. 
This creates a “grounding strap” and 
helps avoid the buildup of a large 
difference in electrical potential 
between the ISS structure and the 
surrounding environment. These 
units would be used, but would they 
be enough to mitigate the risk? As 
it turned out, the time of year was 
favorable and the solar cycle was 
closer to a minimum level of activity, 
so there would not be as many 
charged particles at the ISS altitude 
to create the plasma that would allow 
for a significant jumping of sparks/ 
arcs through space. 

Current flows from the array cells 
to the edges of the arrays, and then 
down to the base, with more and 
more current built up closer to the 
base after gathering input from 
cells along the way down. With the 
damage more than halfway up the 
array, the voltage and current of 
the specific area was known. The 
team determined that a spark could 
not jump more than about half an 
inch between electrically hot spots 
on the array; therefore, a jump 
between the array and Parazynski’s 
metal neck ring on the suit was 
not possible as long as he kept the 
array at a comfortable distance. 
Parazynski might expect to see 
some small arcs, but they wouldn’t 
jump across free space to him. 
Furthermore, the creation of molten 
metal would require a much greater 
level of energy than deemed possible, 
considering where Parazynski could 
potentially come in contact and the 
fact that the tools were taped up. 

Many sharp areas on the array could 
nick a glove, or many areas could be 
energized. Parazynski was told not 
to touch the array with his gloved 
hand. Instead, he had with him a tool 
that had been built inside the ISS, a 


few months prior, to keep a swaying 
array from contacting a crew member 
during an EVA on an earlier mission. 
This tool, called the hockey stick, 
was made of nonconductive material 
wrapped in Kapton tape. The hockey 
stick could be used as a defense to 
push the array away if it came near 
(Figure 16). Vibrations, pushing, or 
the act of the repair could cause the 
array to flap and move, like a sail in 
the wind. This complicated the repair 
because Parazynski needed to keep 
the array close enough to perform the 
repair, yet keep the array at a distance 
using the hockey stick—all the while 
trying to enact the repair and holding 
additional tools. 

5. The Boom Might Be Too Bouncy 

The plan was to have the ISS robotic 
arm grasp the boom at its center, 
with Parazynski standing in a foot 
restraint on a Worksite Interface 
(WIF) Extender, which would 
add approximately 0.9 to 1.2 m 
(-3 to 4 ft) to the overall reach to the 
damage site. He would essentially 
be on the end of an approximately 
27 m (90 ft) pole. Movement of 
his spacesuit could cause ups and 
downs like a fish caught at the 
end of a fishing pole. The team 
had concerns about how much 
Parazynski would bounce around 
after making small movements and 
his ability to avoid smashing into 
the array, inadvertently. Imagine 
trying to perform delicate surgery 
while bouncing on a trampoline. 

Not easy to accomplish! 

Although the Space Shuttle boom 
had not been intended for the purpose 
of getting a crew member close to a 
dangerous solar array, the STS-121/ 
ISS-ULF1.1 crew in July 2006 had 
performed testing while standing on 
a foot restraint attached directly to 
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Figure 16. The team took advantage of a previously constructed tool called the hockey stick, due to its 
shape. It was not as large as a hockey stick, however. It measured 46 by 18 cm (18 by 7 in.). Parazynski 
could use it as a defensive tool if the array swayed near him, since it was made of nonconductive 
material. He would tether to the blue tie wrap loops (redundant in case one of them broke) and hold the 
stick near the end with the tethers. The shorter part of the “L” could be used to push the array away if it 
got too close. The hockey stick is shown floating in the laboratory during Expedition 15. 


the tip of the boom (i.e., without a 
WIF Extender). The test was intended 
to prove that an astronaut could 
stand at the tip of a long boom on 
the shuttle robotic arm to repair the 
shuttle, since it was theorized that the 
boom would feel bouncy and move 
quite a bit as the astronaut moved 
his or her heavy spacesuit. In the 
case of STS-121, the shuttle robotic 
arm grasped the end of the boom. 

The proposed configuration for the 
solar array repair was with a stronger 
robotic arm—the ISS robotic arm— 
grasping the middle instead of the 
end. Although the configuration was 
not tested at these specific arm angles 
with this arm and WIF Extender, it 
was hoped that Parazynski could 
perform his work safely despite 
some bounciness in the system. Team 
members tested the configuration 
using software in the Virtual Reality 
laboratory just to be sure. They 


crafted into the EVA a small test— 
the ground team planned to have 
Parazynski lean in and get a feel for 
the bounciness of his platform before 
starting the repair work. 

6. The Airlock Would Be Far Away 

Typically, EVAs are choreographed 
such that an EVA crew member 
could get back to the airlock within 
30 minutes in an emergency. If, 
for example, the fan/pump/water 
separator unit in the spacesuit (see 
Chapter 17) were to stop working, the 
EVA crew member could open a valve 
in the suit to help with cooling. In a 
worst-case scenario, the suit would 
have enough oxygen for 30 minutes in 
which the crew member would return 
to the airlock while the suit expended 
oxygen through the valve. 

In this case, it was initially estimated 
that it would take Parazynski up to 
an hour to get back to the airlock in 


an emergency. This was eventually 
refined down to 30 to 45 minutes 
by planning where he would tether 
himself, having a quick robotic 
maneuver to the truss ready to go, 
and making sure the on-board crew 
was ready for such a scenario. But, 
because of the critical ISS need to 
have this repair done, additional risk 
had to be accepted when sending 
Parazynski that far from the airlock. 

This risk was debated extensively in 
Team 4 and program meetings since 
standard crew safety practices would 
have to be waived to accomplish 
the task. The 30-minute emergency 
airlock ingress constraint was used 
throughout the ISS assembly and was 
the basis of many decisions related 
to operations and hardware design 
to avoid delaying crew members 
if they needed a quick translation 
back. Therefore, accepting this 
crew risk was not taken lightly. 

One of the factors in accepting the 
risk was that 30 minutes is often 
not an exact number when it comes 
to EVA. For example, in this case, 
there might be some extra oxygen in 
the main tanks, there might be less 
tethers than normal to disconnect 
to start the return, and Parazynski 
was highly experienced. Inherently, 
spaceflight requires taking risks. 

The final decision was that this 
situation was deemed worthy of the 
elevated risk, with the operations 
team making sure an emergency 
return was very well planned to 
be as efficient as possible, should 
a spacesuit failure occur when 
Parazynski was far from the airlock. 

7. The Boom Sensors Might Break 

Using the ISS robotic arm to grab 
the boom instead using of the shuttle 
robotic arm would cause the delicate 
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high-tech imaging sensors at the tip 
to be unpowered for several hours. 

The worry was that the sensors would 
get too cold and become damaged, 
resulting in the inability to inspect 
the thermal protection system of the 
shuttle prior to reentry. The ability to 
perform inspections became important 
after the Space Shuttle Columbia 
accident. The shuttle mission 
management team had to carefully 


consider the possibility that this 
operation might break these sensors. 

Initially, the team estimated the boom 
sensors would be unpowered for 
12 hours, with the sensors getting 
too cold after being unplugged 
between 5 and 8 hours. The robotics 
plan was changed so that the shuttle 
robotic arm would hold the boom 
for some of the preparations, thereby 


reducing the exposure to around a 
predicted 8 hours. After looking at the 
environment, the analysts concluded 
it might remain warm enough to 
prevent the sensors from becoming 
damaged. Because of the criticality 
of the boom usage for this repair and 
some conservatism in the thermal 
analysis, the mission management 
team agreed to use the boom. They 
accepted the risk that these sensors 


Chance Favors the Prepared Mind 

Colonel Doug Wheelock 
STS-120/ISS-10A and Expedition 24/25 

The inside of a spaceship offers a level of normalcy. The 
temperature and atmospheric pressure are fairly constant. 
It is easy to get lulled into a false sense of safety. But the 
moment you open the hatch, the rules change. Oblivion 
resides on the other side of your thin helmet visor. You are 
now engulfed in a dangerous environment of chance. And, 
as we know, chance favors the prepared mind. 

During our 18 months of intensive training, Scott 
Parazynski and I worked diligently in NASA’s Neutral 
Buoyancy Laboratory and Virtual Reality Laboratory. We 
did whatever we could, as many times as we could, to 
replicate the spacewalking environment, talking through 
every conceivable contingency. I grew up hearing the 
mantra “Practice makes Perfect.” However, when 
preparing for spaceflight, that mantra is more accurately 
“Perfect Practice makes Perfect.” No room for error, and 
complacency is met swiftly with dreadful consequence. 

The moment arrived for my first spacewalk. With the 
reduced pressure inside the suit, I could hear a difference 
in my voice, which gets deeper at the lower pressure. 
Scott opened the hatch and said, “Oh wow! Wait until you 
see this, Wheels! We’re over the Himalayas!” 

Nothing quite compares to that first step out into the 
vast universe. Your home planet is far beneath your feet. 
Everything and everyone you have ever known...all on 
that blue planet. And you’re not there. The feeling is quite 
profound, and difficult to put into words. Space is visually 


spectacular and completely breathtaking because of our 
blue planet. It is an explosion of color in the sunlight, an 
oasis of motion and light, suspended in an empty sea 
of darkness. You feel vulnerable. Fragile. Fear is your 
constant companion. The Earth is distracting from this 
vantage point. It is difficult to stay focused, but you have 
to get back to work. 

My second EVA was amazing, bolting down the nearly 
19-ton P-6 truss and solar arrays to the far port end of the 
ISS truss. We finished the task and returned to the airlock. 
Our team worked through the deployment commands for 
the solar arrays. Scott and I were cleaning up when the 
“abort” command was broadcast. I knew that couldn’t 
be good, but I had no idea how that moment would 
shape my life and work, as well as teach me lessons 
about leadership, teamwork, and perseverance that have 
changed who I am as an astronaut and leader. 

The solar array got snagged by a frayed guidewire, and the 
situation was dire. The next few days were full of confusion, 
doubt, and despair. How could we ever repair a torn array? 
Hours and hours passed. We talked about what was likely 
going on down in Mission Control in Houston. We were sure 
NASA had pulled out all the stops to help us fix the station 
and get us home safely. I remember talking with Scott 
in the intervening days about how it felt like Apollo 13. 

I had worked at NASA for 11 years at this point. A calm 
assurance washed over me in that moment. I realized that 
the reason it was so quiet on the voice loops was because 
they were testing a potential solution. I knew in my heart 
that some sharp engineer turned to our team and said, 
“Hey...what if...”? I knew that one day we would look back 
and remember this as one of NASA’s finest hours. 
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might not survive, which would result 
in an inability to check the thermal 
protection system of the shuttle before 
reentry into Earth’s atmosphere. 

8. Spacesuit Failures 

A hole was discovered in the outer 
layer of Wheelock’s right glove 
at the end of the third spacewalk. 
Wheelock’s gloves were changed 


out with a backup pair for the next 
EVA, but the team questioned 
whether something sharp outside 
could puncture a hole in a glove 
during this upcoming EVA, possibly 
even creating a hole into the bladder 
of the suit and springing an oxygen 
leak. Several items that were 
theorized could cause the issue, but 
nothing was the obvious source. 

One leading suspect was a pair of 


foot restraints with difficult-to-turn 
knobs—they possibly had a defect 
or micrometeoroid orbital debris had 
damaged them. The team wanted to 
bring those inside, if possible, on 
this repair EVA for inspection. In 
the meantime, how could the team 
ensure the crew would stay safe from 
sharp edges? This was one more 
complicating factor that had to be 
discussed at length before the EVA. 


Sure enough, our next video conference with our team 
on Earth involved a box full of makeshift parts, fashioned 
together and dumped out on a table, just like in the 
movies! They explained what we were going to do. They 
gave us vectors on where to find cable, pieces of metal, 
and sheet metal tools needed to build “cufflinks” to sew 
the torn solar array. Though years have slipped by since 
that day, it still amazes me that someone thought of this 
solution. It made me grateful to be alive, and grateful to 
be part of the NASA team. The plan was full of danger 
and unknowns. We taped everything metal on our 
spacesuits, including the neckring of our helmets, which 
really got my attention. I was going to be responsible 
for keeping Scott safely clear of the billowing array, so 
it wouldn’t fry the electronics in his suit and electrocute 
him. I was also responsible for feeding the guidewire 
cleanly into the inertial reel, while maintaining control of 
the wire. The engineers told me to keep my suit clear of 
the wire, since it retracts at 10 feet per second. They were 
concerned that if I lost control of the wire, it would tear 
through the solar array and even through my suit! Trust 
me, they had my undivided attention! 

It was game day, November 3, 2007. Scott was stoic 
and focused. I was full of fear, but if I was purposed and 
methodical, I would increase my chances of success. 
There is a saying we have in the astronaut corps, that 
there is no situation in space so bad that you can’t make 
it worse. Spacewalking demands a balanced level of logic 
and impulse, and the clear recognition of danger. 

When I exited the airlock, I felt like a machine. I knew what 
I had to do, and I wanted to get on with it while adrenaline 
still coursed through my veins. Mission Control told us 


they were going to maneuver the ISS to shadow as much 
of the array as they could to reduce the electrical power 
generation of the arrays, resulting in me being in shadow 
for the next 7+ hours. Scott was in position to cut the 
frayed part of the guidewire. I reached inside of the array 
with the needle-nose pliers to control the guidewire and 
give Scott a “go.” I held a metal tool mere inches away 
from the array power strip that carried 200 amps of current, 
and I was a bit nervous. But, everything went smoothly and 
the cable retracted fully into the inertial reel well. 

Scott finished installing the five cufflinks. We were ready 
to clear the area. The robotic arm operator maneuvered 
Scott away from the array and back to structure. I was 
asked to return to the airlock. By this time, my teeth were 
chattering and I couldn’t wrap my fingers around anything. 
My heart was pounding, and I had to figure out a way to 
warm my hands. I noticed a sliver of sunlight on the top 
of the mast canister, so I crept up the mast and stuck my 
hands into the sunlight. It took a couple minutes, but my 
hands warmed enough to grip the handrails and my tools, 
and make my way back to the airlock. 

Our repair worked! The array fully deployed, and the 
cufflinks are still holding to this day, years later. 

Now when I am asked what it is like to do a spacewalk, 
the answer is not so simple. It is mentally and 
psychologically the toughest yet most rewarding work I 
have ever been a part of. I have never felt more mortal 
than when I was out on a spacewalk. I have never felt as 
cold as I did that day in November 2007. But the sense of 
pride I will feel to the end of my days, of being a part of 
something great, is overwhelming. 
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A set of “overgloves” was planned 
into the EVA to provide for this 
sort of protection. Overgloves were 
mittens that fit over the index finger 
and thumb and covered the most-used 
glove areas. They were somewhat 
loose, thereby reducing the overall 
dexterity of the crew member’s hands 
even more than the spacesuit gloves. 
The team members expressed many 
concerns about using overgloves 
when doing fine detailed EVA work-— 
they didn’t want Parazynski unable 
to perform the repair, snagging the 
overglove, or having hand fatigue. It 
was agreed that both Parazynski and 
Wheelock would wear these gloves, 
but when Parazynski got on the tip 
of the boom, he would remove his 
overgloves to perform the repair. 

Also on EVA 3, Parazynski’s 
spacesuit exhibited increasing 
temperatures due to a theorized failure 
of his sublimator (the component 
that rejects heat). The team declared 
his primary suit “no-go” for use on 
this upcoming EVA. The crew had to 
spend extra time to size a different 
spare suit to fit him. 

9. Lack of Time 

To pull off this kind of repair 
spacewalk could take weeks of 
preparation in various ground 
facilities; however, only a handful 
of days remained before the shuttle 
would run out of consumables and 
have to depart. Even simple EVAs 
are usually trained in the Neutral 
Buoyancy Laboratory several times 
before attempted in space. With so 
little time, a lot of “gut feel” from 
engineers, flight controllers, and 
experienced crew would have to be 
used to assess robotic motions and 
unknown array dynamics during 
the repair. Unfortunately, the same 


people who had worked so hard 
(i.e., electrical power experts, EVA 
teams), day and night, to come up 
with the SARJ EVA had to now work 
the solar array issue day and night 
until it was fixed. 

The array snag occurred on 
Tuesday, October 30, after EVA 3. 

On Wednesday, the team changed 
direction, completely dropping 
all work on the SARJ and instead 
working exclusively on the repair 
EVA. Highly optimistic thinking 
put the repair EVA on Friday, with 
a second EVA possible before 
undocking. Everyone felt the pressure 
to perform a successful repair before 
the shuttle and its boom departed. 


Flight Day 10 
(Thursday, November 1) 

As Friday approached, flight 
controllers worked around the 
clock (many working 12 hours or 
more at a time), and things were 
coming together the night before 
the spacewalk. Almost. The team 
struggled to get the final procedures 
on board, the console positions in 
mission control were not feeling 
ready, and the team working the 
repair EVA details was exhausted. 

The flight directors involved 
recognized these clues as “links in 
the error chain” building up. Accident 
investigations often point at links 
in the error chain where a series of 
events led to the accident—if any 
one event had been recognized and 
stopped, the accident could have been 
prevented. In this case, the team was 
not meeting all of the deadlines, and 
people were heads-down writing the 
details to the point of not looking 
ahead to keep important big-picture 


issues in mind. Flight controllers 
might have pulled off the EVA that 
Friday, but that sick feeling that 
everything was not under control 
meant an error chain was perhaps 
developing. The team needed one 
more day. The flight directors 
and program management agreed 
to move the EVA from Friday to 
Saturday. This meant the array had 
to be repaired on a single EVA—no 
falling back on a second EVA since 
there would not be time for a follow- 
on EVA before the shuttle would 
have to undock with its remaining 
consumables to make it home. 

Flight Day 11 
(Friday, November 2) 

With the EVA now scheduled for 
Saturday, the final conferences 
were conducted on Friday with the 
crew to discuss the repair details 
and robotics. EVA crew members 
had procedures on board that they 
printed out and taped to their cuff 
checklist so that Parazynski would 
have a graphic representation of 
where he would install the cufflinks 
(Figures 17-19). Tani and Wilson 
would be the station robotics crew 
members, and they had procedures 
on board and were feeling ready. 

The general order of events was to be 
as follows: 

1. The IV crew would robotically 
position the tip of the boom near 
the port side of the truss, ready for 
the EV crew. 

2. The EV crew would install the 
WIF Extender and a foot restraint 
onto the tip of the boom, and 
Parazynski would put his feet into 
the foot restraint. 
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3. The IV crew would robotically 
move Parazynski to the damage 
while Wheelock translated 
“free-floaf ’ (i.e., using his hands, 
grabbing handrails) to the base 
of the array to help provide 
clearance calls to Parazynski 
about his distance to the array. 

4. Parazynski would install the 
first cufflink to carry some 
load in case the array started 
moving significantly. 

5. Parazynski would clear the snag 
using his best judgment by pulling 
parts of it free using pliers, flicking 
small parts using a spatula, or 
trimming a hinge wire. Among 
other tools, he had with him a pair 
of borrowed Russian cutters called 
“dinocutters,” due to the dinosaur¬ 
like shape of them. 

6. Only if necessary, Parazynski 
would cut out the snag by cutting 
the long vertical guidewire and 
allowing it to retract into a spooled 
reel at the base of the array 
where Wheelock would ensure 

a good feed into the reel. There 
was a concern that it would have 
trouble reeling in and snag some 
more; therefore, the team had 
contingency procedures developed 
in case of additional loose wire to 
deal with. After the snag was in 
Parazynski’s trash bag, this would 
leave the top of the guidewire free, 
which was deemed acceptable. 

7. Parazynski would shape the array 
back into a loosely accordion shape. 

8. Parazynski would install the other 
four cufflinks. 

9. Mission Control would command 
the array deploy very slowly 
with the crew watching (and the 
helmet camera sending back live 
in-situ video). 



Figures 17. High-level instructions sent to the crew based on the imagery available. Detailed 
procedures were also sent up. 
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WARNING 

1. Sharp edges: 

a. SABB (skirt, swing bolts) 

b. Solar cells 

c. Springs along tension bar 

d. Panel hinges 

e. Guide cable burrs or frays 

f. Mast Canister roller guides 

g. Braided cables 

h. Fastener exposed threads 

i. Exposed bolts in rib cavities on mast canister 

2. Shock hazard: 

a. Avoid EMU contact with FCC and Kapton part of solar array panels 

b. EV crew will only contact energized surfaces with approved tools that have been insulated with 
Kapton tape to prevent molten metal and shock 

c. Solar array to be manipulated will be shunted prior to EV crew entering worksite 

3. Pinch: 

a. Lower SABB exposed reels and pulleys (guide wire and tensioning mechanisms) 

b. Solar array mast during deploy/retraction 

4. Avoid inadvertent contact with: 

a. SSU, ECU, beta gimbal platform, mast canister, SAW blanket boxes unless the beta gimbal is 
locked and the motor is turned off 



Figure 18. 

Detailed warnings sent up 
to crew to study in advance 
of the EVA. 

(SABB = Solar Array Blanket Box; 
EMU = Extravehicular Mobility Unit; 
FCC = Flat Collector Circuit; 

SSU = Sequential Shunt Unit; 

ECU = Electronics Control Unit; 
SAW = Solar Array Wing) 


WARNING 

1. Verify glove gauntlets cover wrist disconnects 



WARNING 

Minimize contact between metal array components and exposed damaged solar cells on active side. Note 
some sparking may be expected. 

Avoid contact with solar panels except with insulated tools. 

Sharp edges likely present at damage locations. 
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Figure 19. Graphics that the crew printed out on board and taped to Parazynski’s cuff checklist. He could look down at his wrist to make sure he knew 
exactly where each end of each cufflink was installed. The nomenclature "stiff” refers to strips of material called "stiffeners” that run the length of the 
blankets, somewhat helping to rigidize the array. These and the bay numbers 32 through 40 were there to help the control center and crew have a common 
nomenclature if they noted an issue with a particular area. None of the bay numbers were physically marked on the arrays. 
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Flight Day 12 
(Saturday, November 3) - 
Solar Array Repair 
Extravehicular Activity Day 

The EVA was pretty spectacular. 

When the EVA crew members went 
out to the truss, they found the boom 
was fairly stable (Figure 20). The tip 
was positioned farther from the truss 
than it would normally be so as to not 
impact the truss, which created some 
challenging moments. The EVA crew 
members had to assist each other in 
getting back and forth to the tip, even 
crawling on one another’s backpack 
for reach (showing that even when 
meticulously planned, the crew and 
flight control team still need to adapt). 
The WIF Extender on the tip of the 
boom resulted in some flex, but the 
crew found it manageable. 

Parazynski had an incredible 
40-minute ride to the damage site, 
with sweeping views of the ISS from 
a distance. Upon arrival, he described 
the damage for the ground team and 
called it a “hair ball.” Based on this 
description, the team knew it would 
require the more complex of the 
repairs envisioned, and he would 
have to cut the long guide wire. 

When it came time to cut the 
guidewire, the video was not 
transmitting to the ground due to 
blockage of the Ku-band antenna 
(see Chapter 13). While the Mission 
Control team held its collective 
breath, Parazynski cut the wire and 
Wheelock controlled the speed as 
it zipped into the reel at the bottom 
of the array. When Wheelock 
reported the array had successfully 
retracted, the team in the control 
center literally cheered. 



Figure 20. Parazynski riding on the OBSS—"the boom”—to perform the array repair. The boom 
is grasped by the ISS robotic arm. The other end of the arm is grasping part of the Mobile Remote 
Servicer Base System on the truss. This photo was taken by the crew inside the ISS, whose main task 
at this time was operating the arm and monitoring the EVA crew. Wheelock is not shown in this photo 
because he is translating along the truss structure using his hands. 



Figure 21. Parazynski is being hoisted to the repair site, approximately halfway up the array. 
Wheelock is at the base of the array, looking up to give clearance calls so the loose array would not 
come in contact with his crewmate. 
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Figure 22. Parazynski, partway through 
the repair. Three of the five required cufflinks 
are installed. 


The cufflinks installed pretty easily, 
thanks to a good ground design 
and build-up by the crew. But the 
installation into the upper holes 
required more reach than the robotic 
arm possessed. Some truly tense 
Mission Control moments occurred 
when the arm was stretched as far as 
it could go, yet Parazynski needed to 
go a little bit higher even though he 
is a tall individual. This situation felt 
like a simulation in Mission Control 
when instructors throw a really hard 
malfunction in to see if the flight 
controllers sweat. In the end, the 
ground agreed to have Parazynski 
pull the upper part of the array 
down some using his tools, thereby 
allowing him to install the upper 
end of the cufflinks. Figures 21-25 
show the view on the ISS during the 
spacewalk, whereas Figure 26 shows 
the activities going on inside Mission 
Control during the EVA. 



Figure 23. Parazynski is watching the array unfurl and photographing the final state of the cufflinks 
(top right) after performing the repair. The control center watched the repair sites during the array 
deploy to determine whether the repair was working. The control center view was from a video camera 
mounted on Parazynski’s helmet. 



Figure 24. The repair was successful in bridging the gaps in the array with the white cufflink cords 
holding together the pieces so the hinge areas did not zipper open any further. 
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Figure 25. This photo of Parazynski just after cufflink installation was taken by Wheelock, who was at the base of the array The cufflink repairs are the 
white cords partway up the array 



Figure 26. Photos of Mission Control during 
the EVA. (A) Flight Director Derek Hassman 
leaning on console, with Capcom Steve Swanson. 
(B) Some Team 4 key players: (left to right) Flight 
Director Annette Hash rook, astronaut Joe Tanner, 
EVA specialist John Ray, and Mission Evaluation 
Room manager Becky Tures. (C) Robotics officer 
Sarmad Aziz. (D) (left to right) Flight Surgeons 
Dr. Sean Roden and Dr. Robert Haddon, 
Biomedical Engineer Chris Goetter, and EVA 
officer Dina Contella (2 years later, Contella was 
selected as a flight director). (E) (left to right) 
Electrical Power experts at the PHALCON position, 
Tamara Cougar and Scott Stover (2 years later, 
Stover was selected as a flight director). 



D 
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The team predicted the EVA would 
be fairly long. The EVA team in 
the control center had to balance 
reserving the consumables of the 
spacesuit with the criticality of 
having Parazynski (and his helmet 
camera) watch deploy of the array. 
After a lot of discussion about the 
suit consumables while Parazynski 
cut the guidewire and installed the 
cufflinks, the team decided enough 
spacesuit consumables remained 
to have the EVA crew watch as the 
array successfully deployed. The 
spacewalk ended up with a duration 
of 7 hours 19 minutes, which was 
not too exceptional, due to quick 
work by the crew to clean everything 
at the end of the EVA. The crew 
even managed to retrieve the two 
suspect foot restraints so that 
they could be inspected inside for 
sharp edges. 

The tools worked great, and 
Parazynski used the hockey stick 
like his “best friend” to keep the 
array at a safe distance. During the 
EVA, a pair of needle nose pliers 
was lost overboard (i.e., floated 
away from the ISS) due to the way a 
tether line was routed. However, the 
Trajectory Operations Officer quickly 
analyzed the trajectory of the tool, 
and determined the pliers did not 
pose a risk for coming around and 
hitting the ISS on a later orbit. Weeks 
later, the team discovered during 
video review that another tool had 
been lost—the Russian dinocutters. 
This loss was not noticed during the 
mission, which is unusual. The crew 


and ground team missed double¬ 
checking the presence of this tool 
during the post-EVA tool review, 
probably due to the last-minute 
nature of the activity and the need 
to focus on the end of the mission 
and shuttle undocking. Also, a 
camera did not work on that EVA. 
The camera had the same signature 
as the camera failure on EVA 2, 
which was later theorized to be a 
blanket holding down the shutter 
button and draining the battery. The 
boom sensors had been unpowered 
around 9 hours, but a checkout later 
confirmed they were working. 

The array deployed to its highest 
tension mode (i.e., the regular 
operational mode for the array) and 
rotated nominally. It was generating 
217 amps, which is 3 amps less than 
what would be expected normally. 
This was probably due to damage of 
some of the cells, but only a small 
fraction of the power generation 
capability had been lost. As of this 
writing, the array repair with its 
cufflinks has held together well for 
several years—a testament to those 
who worked so hard to put it in 
working order. 

With this success, the shuttle could 
undock. The next EVAs were 
already being put on the plan for 
the ISS crew, including the deferred 
stage EVA that Whitson and 
Malenchencko were to perform after 
the shuttle departed. The European 
Columbus module ultimately flew up 
during the STS-122/ISS-1E mission 
in February 2008. 


Looking Back 

Adaptation was key. Before flight, 
the team meticulously pre-planned 
for three spacewalks (one of which 
was altered in flight to examine 
a failing truss rotary joint), then 
added a fourth and fifth spacewalk 
pre-mission, neither of which was 
actually executed during that mission. 
That mission was altered by adding 
a new spacewalk in flight due to a 
major failure in a rotary joint. That 
spacewalk was not executed during 
the mission either. Ultimately, 
through an enormous effort by a large 
technical international community, 
flight controllers and engineers 
executed an entirely new spacewalk 
to repair a damaged solar array. 

Preparations for the unexecuted EVAs 
were not wasted, however. That hard 
work created a solid team that was 
able to change the spacewalks, in 
the moment, and execute them as if 
they had been planned and tested on 
the ground, preflight. Even though 
some additional risk was accepted for 
one of the most critical spacewalks 
done to date, the flight directors and 
mission management team ensured 
that the team was properly ready and 
no unnecessary risks were taken by 
the team or the crew. 

In hindsight, a combination of factors 
came together in a perfect way to 
enable this success. For example, the 
Space Shuttle boom was available, 
enabling reach to a distant place that 
would not have been possible before 
the Columbia accident decisions 
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that led to flying a boom for shuttle 
repairs. Additionally, a history of 
smaller but also critical past solar 
array deploy issues seasoned the 
electrical power and EVA teams, 
readying them in advance for this 
incredibly daunting challenge. A 
skilled robotic and EVA crew, strong 
leadership on board the shuttle and 
ISS as well as on the ground, and 
experienced flight controllers in 
Mission Control were all contributing 
factors in this success. These factors 
were not “dumb luck.” NASA and 
Flight Operations spend a lot of time 
preparing for the unforeseeable. Even 
in the best of conditions, factors do 
not always come together, which 
is why this team was relieved and 
exuberant with the outcome. 

It had been an incredible spacewalk 
and mission. Cheering had erupted in 
Mission Control, and the celebration 
was well earned. However, the next 
spacewalk by the ISS crew was only a 
few days away, which meant the team 
would soon get back to business. 
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Chapter 19 Systems: 

Environmental 
Control and 
Life Support System 
Supporting the 
Human Element 
of the International 
Space Station 




Astronauts drink water that has been recycled from 


If Command & Data Handling is the 
brains of the International Space 
Station (ISS), the Environmental 
systems are the heart and lungs of 
the vehicle . 

Adding humans to a spacecraft brings 
a significant overhead in terms of 
life support. An atmosphere must be 
provided for humans to survive in the 
harsh frontier that is space; living in a 
space suit would be neither practical 
nor supportable for any significant 
amount of time. 

A fundamental aspect of the 
ISS is to provide a shirtsleeve 
environment in which astronauts 
can conduct research. To this end, 
the Environmental Control and 
Life Support System (ECLSS) 
provides a breathable atmosphere at 
a normal atmospheric pressure. This 
means the system provides oxygen 
(0 2 ) and nitrogen (N 2 ) at the same 
ratio as on Earth while removing 
contaminates such as carbon dioxide 
(C0 2 ) and other impurities in the 
gas. As on Earth, water is the most 
critical consumable after 0 2 . Water 
is required for survival, rehydrating 
food, bathing, and waste removal. 



urine and sweat on the International Space Station. 

Early space stations such as Skylab 
required the astronauts to carry with 
them all the gas and water, which 
were consumed. On the United 
States On-orbit Segment (USOS), 
the goal is to recycle and generate 
as much of these commodities in as 
closed loop as possible. For example, 
drinking water turns into perspiration 
and urine. In turn, sweat is collected 
out of the atmosphere by a 
dehumidifier while urine is separated 
from other waste and stored. The 
sweat and urine are then carefully 
processed back into drinking water. 
These types of technologies and 
processes will need to be well 
established and reliable if humans 
are to travel to Mars. 

The ISS life support system is 
designed to handle seven crew 
members routinely and can support 
a surge of up to 11 for a brief period 
of time. Pressure on the ISS is 
normally maintained between 724 to 
770 mm Hg (14.0 to 4.9 psi), which 
is equivalent to what is experienced 
around sea level on Earth. For 
crew comfort, temperatures are 
maintained at 22°C to 26°C (72°F to 
79°F). Humidity can be controlled 



to whatever level is desired, but it 
is generally kept low (-45%) for 
crew comfort and to minimize water 
condensing on critical surfaces of the 
space station. 

The Environmental and Thermal 
Operating Systems (ETHOS) 
flight controller is responsible 
for monitoring these systems 
continuously; ETHOS carefully 
tracks 0 2 , C0 2 , and every drop of 
water. Many of these same systems 
are found on the Russian Segment 
(RS); therefore, careful coordination 
is required between the two teams. 
Since most emergencies (i.e., fire, loss 
of atmosphere, chemical spill) affect 
the atmosphere, ETHOS has one of 
the most critical jobs on the flight 
control team: emergency response. If 
any of these problems occur, ETHOS 
guides the flight control team and 
astronauts through the procedures, 
thereby ensuring crew safety. Of all 
the areas in which the flight control 
team trains, emergencies get the 
most attention. Fortunately, to date, 
no serious problems have occurred, 
mainly due to the vigilance of the 
ETHOS team. 
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Atmosphere Control 
and Supply/Atmosphere 
Revitalization 

On the ISS, 0 2 and N 2 levels are 
maintained to values typical of those 
on the surface of Earth at sea level. 
Dry air consists of about 78% N 2 
and 20% 0 2 , by volume. Human 
respiration takes 0 2 into the lungs, 
which is absorbed in the body, and 
releases C0 2 ; gaseous N 2 , being 
inert, is not consumed in the process. 
Hypoxia, and eventually death, will 
occur if the 0 2 levels drop too low. 

In certain cases, humans can survive 
for limited intervals with lower 
levels of 0 2 . The 0 2 level may be 
dropped to the equivalent altitude 
of 3048 m (10,000 ft) for up to a 
day in a contingency. As the crew 
members breathe, O 0 levels need to 
be replenished over time. In a perfect 
system, N 2 would never need to be 
resupplied; however, a small amount 
of leakage occurs on the ISS, as 
well as lost gas, when vestibules are 
depressed to allow vehicles to depart, 
thus necessitating replenishing. 

It is important to keep the level 
of 0 2 high enough for the crew to 
adequately breathe, but not so high 
as to create a flammability risk, as 
0 2 is a highly flammable gas. If the 
concentration of 0 2 is kept lower 
than approximately 24%, the risk of a 
spark causing a combustion event is 
fairly low at the atmospheric pressure 
on the ISS. Short-term exceptions 
are allowed during preparation for 
spacewalks (see Chapter 17). 

Two ways to get these critical gases 
on the ISS include delivering the 
gasses in a tank or generating them 
in situ. Various vehicles—Russian 


Progress, European Space Agency’s 
Automated Transfer Vehicle, Space 
Shuttle, Japan Aerospace Exploration 
Agency’s H-II Transfer Vehicle 
(HTV), Dragon, and Cygnus— 
transport 0 2 , N 2 , or air (a mixture of 
N 2 and 0 2 ) to the ISS. Progress and 
the Automated Transfer Vehicle have 
large storage tanks. A valve is opened 
for a predetermined amount of time 
to bleed some 0 2 , N 2 , or air into the 
main cabin whenever the atmosphere 
on the ISS requires more gas. 

Three 0 2 tanks are situated outside 
of the airlock. One tank is used to 
resupply the atmosphere, whereas 
the second and third are primarily 
used for the Extravehicular Activity 
(EVA) Mobility Unit (EMU) (see 
Chapter 17) and are intended to be 
used only for the general atmosphere 



Figure 1. Astronaut Dan Burbank works on the 
0GA during Expedition 30. 


in an emergency. A fourth 0 2 tank 
is stowed outside on the ISS truss. 
This tank can be accessed via an 
EVA, if the tank is required. The 
Dragon, Cygnus, and HTV vehicles 
can also bring up 0 2 and N 2 tanks, 
which are called the Nitrogen and 
Oxygen Resupply Systems tanks. The 
tanks can either be vented directly 
to the cabin, as above, or be used to 
resupply the external 0 2 and N 2 tanks 
outside of the airlock for future use. 

Transporting 0 2 to the ISS is costly; 
therefore, it is better to generate 
0 2 in situ where possible. Both the 
USOS and the RS have generators 
that can produce 0 2 from water using 
electrolysis, which is the process 
of splitting water molecules into 
hydrogen (H 2 ) and 0 2 using electricity. 
Having two independent systems 
provides redundancy if one suffers 
a problem. The Oxygen Generation 
Assembly (OGA) (Figure 1) performs 
this task on the USOS. 

Finally, 0 2 can be supplied by the 
Solid Oxygen Generator where 
solid “candles” are burned, thereby 
producing 0 2 as a by-product. 

Candles have been used in places 
such as submarines for years. These 
candles are used in an extreme 
contingency case due to flammability 
risk (see Dragonfly , 1998). The 
ETHOS flight controllers monitor the 
0 2 levels closely and work with their 
Russian counterparts to ensure the 
right levels are always available. 

The Pressure Control Assembly 
(PCA) monitors the total pressure 
of the cabin air. Similar sensors are 
present in the Columbus Module and 
Japanese Experiment Module (JEM). 
Not only does the PCA measure the 
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total pressure and trigger an alarm if 
the pressure gets too high or low, the 
PCA can automatically introduce 0 2 
and N 2 from the external tanks on the 
airlock. As discussed in Chapter 3, 
pressure above a critical limit can 
rupture the shell of the ISS, thereby 
introducing a catastrophic leak. 

Too low of a pressure can cause the 
astronauts to lose consciousness 
and die. If the pressure gets too high 
(>777 mm Hg or 15.03 psi), the PCA 
uses its Vent and Release Assembly 
(VRA) to release gas outside of the 
spacecraft. In case of a problem 
with the VRA, the Positive Pressure 
Release Assembly (PPRA) can also 
vent the atmosphere. The trigger 
point of the PPRAs (>778 mm Hg or 
15.05 psi) is set higher than the PCA 
and would only vent in a significant 
emergency. The PPRAs are 
essentially large vents on the ISS, 
and they can release about 68 kg/hr 
(-150 lbs/hr) of gas. These might also 
be used in an emergency response 
(see below). However, the flight 
control team monitors the atmosphere 
closely since any gas that is vented 
is a waste of a critical commodity. 
Similar devices are present in the 
Columbus Module and JEM. 

Careful measurement of the 0 2 and 
N 2 quantities in the atmosphere is 
required for the PCA or the ETHOS 
flight controller to know whether 
either levels need to be adjusted. 
Composition of the atmosphere is 
measured by the Major Constituent 
Analyzer (MCA). The MCA consists 
of a mass spectrometer that can 
measure 0 2 , N 2 , C0 2 , H 2 , water, and 
methane in the atmosphere. The 
US OS is lined with tubes that make 
up the Sample Delivery System 
(SDS). The MCA draws in a small 
sample of atmosphere from each 


module and measure the constituents. 
An alarm will be annunciated if any 
component is outside of the expected 
limits. If this occurs, the MCA will 
repeatedly sample the atmosphere in 
that module so the crew and ground 
can monitor the situation. Otherwise, 
the system will move on to the next 
module and keep cycling. 

Several handheld devices can also 
be used to measure atmospheric 
contaminants. These devices 
consist of the Carbon Dioxide 
Monitor (CDM), the Compound 
Specific Analyzer-Combustion 
Products (CSA-CP), and the Chip 
Measurement System (CMS). See 
Figure 2. All three devices work 
essentially the same way by pulling 
in cabin air and measuring the 
constituents. The CDM is mainly 
used in situations when a localized 
area needs to be monitored; e.g., if 
a crew is working in an area where 
ventilation is poor. The CSA-CP 
is the main tool to determine the 
constituents of smoke or whether 
there is a fire inside of a rack. 

It measures the levels of carbon 
monoxide, hydrochloric acid, and 
hydrochloric cyanide—typical and 
dangerous by-products of a fire for 
the type of materials used on the 
ISS. The CSA-CP has a long tube 
attachment that can be inserted 
into holes in the racks to measure 
the presence of smoke that may 
not be visible. Finally, the CMS 
on the US OS measures ammonia, 
whereas the Russian CMS detects 
formaldehyde, benzene, styrene, 
ozone, phosgene, carbon monoxide, 
ammonia, and nitrous fumes. 

After 0 2 and N 2 , C0 2 is the next- 
biggest atmospheric concern. Even 
low levels of C0 2 can impair the 
mental acuity of an astronaut, 


especially if the exposure occurs 
over a long period of time. The 
amount of a gas is measured in 
terms of partial pressure, which 
is the amount of the pressure that 
a specific gas contributes to the 
total pressure. The average partial 
pressure of C0 2 at the surface of the 
Earth is less than 1 mm Hg, or about 
one-tenth of a percent of the total 
pressure. On the ISS, the level is 
maintained to be less than 4 mm Hg 
and is typically around 3.5 mm Hg. 
Some astronauts reported headaches 
when the levels went above this 
amount. Exposure to values above 
20 mm Hg can lead to headaches, 
increased respiratory rate, reduced 
performance decrement, and possible 
depression of the central nervous 
system. Recent research may also 
indicate that a person’s sensitivity 
may change in weightlessness. The 
primary way of removing C0 2 on 
the USOS is via the Carbon Dioxide 
Removal Assembly (CDRA). See 
also Figure 3. A similar device is 
located on the RS. In the event of 
failure, the crew can load Lithium 
Hydroxide (LiOH) canisters into 
a fan assembly to filter the C0 2 
as a backup. The LiOH canisters 
absorb C0 2 in a chemical reaction. 
However, this is a contingency plan 
only, as it uses a non-regenerative 
consumable. Even maintaining low 
levels is not adequate to keep crew 
members healthy. Gravity causes 
warm gases to rise and cooler ones 
to sink. This helps mix atmospheric 
gases, dispersing those such as 
C0 2 . In the absence of gravity, 
fans are needed to perform this 
function on the space station or as 
an astronaut breathes in one place, 
since a local pocket of toxic gas can 
build up. The ventilation on the ISS 
is designed to keep levels of C0 2 
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Figure 2. CSA-CP (left) attached to the wall of Node 1 and CMS (right). For the CSA-CP, the metal detector (gray), which is about 15 cm (6 in.) in length, 
is placed in the black holder that pumps air in through a tube, which is currently connected to a long rod that can be inserted into racks. 


uniform. This is even more critical 
in the small phone-booth-sized crew 
quarters where crew members sleep. 
Therefore, redundant fans and an 
alarm system are present in those 
units to ensure the health of the 
sleeping astronaut. 

A CDRA is located in both the 
Laboratory module and Node 3 
module, though only one at a time 
is usually operating. Note that it is 
not practical to operate both CDRAs 
simultaneously to lower the C0 2 
level further. The CDRA consumes a 
significant amount of power (around 
1 kW) and generates a significant 
amount of heat. Operating a second 


unit can lower the level further, but 
at the expense of wearing out sooner. 
The CDRA is actually two sets of 
filter bed systems that alternately 
operate one set to purify the air 
while the other is being cleaned. Air 
is first pulled into the CDRA from 
the Common Cabin Air Assembly 
(CCAA) over a bed of desiccant to 
remove humidity. The desiccant bed 
uses silica gel and zeolite, and is 
similar to the small packets found 
in food products or shoes. Drying 
the air allows the next filter bed, 
an absorbent material, to remove 
the C0 2 more efficiently. The air 
is then pushed through a second 


desiccant bed that was previously 
used to remove water vapor and 
therefore contains excess water. This 
actually rehydrates the air a little 
before it reenters the cabin. After a 
while, the absorbing bed becomes 
saturated and can no longer remove 
the C0 2 . At this point, it is taken 
out of the air flow and heated to a 
high temperature, which causes the 
trapped C0 2 to be released. Released 
C0 2 is either vented to vacuum 
or piped over to the Sabatier (see 
below). The second set of desiccant 
and absorbent beds remove C0 2 
while this bake-out is occurring, 
and the cycle keeps repeating. 
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Figure 3. CDRA and the TCCS in the Atmosphere Revitalization Rack—schematic (left) and actual rack before launch (right). Also seen in the drawing 
are the MCA, the Remote Power Control Module (which powers the rack), and a fan that helps blow smoky air over the smoke detector to determine the 
presence of fires as well as to provide cooling. The Rack Power Switch allows the crew to power off the entire rack quickly in the event of a fire. 


Another tool in keeping the air 
clean is the Trace Contaminant 
Control System (TCCS). The TCCS 
(Figure 3) can remove most of the 
more than 200 possible contaminants 
on the ISS, including hydrocarbons, 
ketones, silicones, aldehydes, sulfides, 
and inorganics. The TCCS works 
mainly by pulling air through various 
filter beds that consist of activated 
charcoal, a catalytic oxidizer, or 
LiOH. The TCCS can even absorb 
small amounts of ammonia, but it 
would be inadequate in the event of 
an Interface Heat Exchanger (IFHX) 
breach. Once the filters have absorbed 
as much contaminants as they can 


hold, they are disposed of and new 
ones are installed. 

After providing the crew with the 
proper atmosphere needed to live and 
work, the next priority of the ECLSS 
is to offer support for scientific 
payloads. Nitrogen lines are plumbed 
throughout the Laboratory module 
and can be fed into payload racks. 
Nitrogen is usually used to purge 
some other gas from an experimental 
rack, but nitrogen may have other 
uses determined by the researcher. 
Also, two types of vacuum lines are 
available for the payloads. One type 
is the Vacuum Resource System 
(VRS), which is an open line to 


space. Although the space around the 
ISS is not a perfect vacuum, owing 
to small amounts of gas (mostly 0 2 ), 
the pressure is about 10 to 100 billion 
times lower than at the surface of the 
Earth and is as good or better than 
the best vacuum chambers on Earth. 
If an experiment requires vacuum to 
operate, it would be connected to this 
system to allow a constant vacuum, 
as needed. This will occur after the 
experiment itself has undergone 
careful analysis to ensure it cannot 
easily leak. If an experiment uses 
chemicals or gasses that need to 
be removed after a trial run (e.g., 
during combustion research), these 
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can be removed by hooking up to the 
Vacuum Exhaust System (VES)—a 
similar line running to space. One 
key difference in the VES is that 
the opening to space is directed 
away from any important structure; 
therefore, residue doesn’t build up on 
critical surfaces. The VES also has a 
diffuser attached so that the escaping 
gas imparts no particular thrust. 

A final component of the atmospheric 
control system is the Intermodular 
Ventilation (IMV) shown in 
Figure 4 for Node 2. The IMV 
system is basically a bunch of air 
ducts plumbed around the US OS 


to exchange air between modules, 
thus allowing for good mixing. It is 
critical to mix the 0 2 generated by 
the OGA; this will allow the crew 
to breathe and will prevent pockets 
of toxic C0 2 from forming, as noted 
above. Fans push the air between 
modules through the ducts, whereas 
intramodular air circulation occurs 
within the individual modules via 
the cabin fan or CCAAs. The IMV 
system can recirculate all the air 
inside the ISS in about 2-3 hours. In 
the case of a fire or chemical spill, 
IMV fans are shut off and IMV valves 
actually close to prevent further 
mixing of anything bad throughout 


the vehicle. The hatch can be closed 
to completely isolate a module in the 
event of a serious emergency. The 
pressure on both sides of the hatch 
needs to be the same when opened; 
otherwise, the crew will be unable to 
move it. Even a pressure differential 
of only 0.3% of that at sea level—a 
differential too small for a human to 
detect—can make it impossible to 
open a hatch because the hatch area is 
so large. Therefore, Manual Pressure 
Equalization Valves (MPEVs) are 
located on the hatches to allow the 
air to balance out before opening the 
hatch. An example of the IMV system 
is shown in Figure 4. 
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Figure 4. An example of the plumbing for the IMV. In this case, for the Node 2. The forward port valve is at the front of the module, whereas the after 
port valve is at the far end, approximately 7.2 m (~24 ft) away. The CCAA is approximately in the middle of the module. Arrows show the flow of air into 
and out of the CCAA. 
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Temperature and Humidity 
Control 

Not only does the crew need to 
be comfortable, some equipment 
requires the air in the ISS to remove 
excess heat (i.e., air cooled). 

CCAAs in the Laboratory, Node 2, 
Node 3, and airlock, and similar 
air conditioners in the International 
Partner modules, circulate, cool, 
and dehumidify the air. The CCAAs 
are connected directly to the IMV 
ducting (Figure 4). The ducting 
passes air between all the modules to 
ensure uniform mixing. 

Air is pulled into ducts that feed the 
CCAAs and passes through High 
Efficiency Particulate Air (HEPA) 
filters, in the same way as household 
systems do on Earth. Although the 
crew and spacecraft are kept as clean 
as possible on the ground, a fair 
amount of particulates are present 
on the ISS. These filters have to be 
vacuumed fairly regularly since, in 
microgravity, objects collect on the 
inlet of vents and not on the floor. 

This process also acts as a handy 
way to find missing items—e.g., lost 
screws, misplaced washers, small 
tools, or even a pack of gum or a fork. 

A fan pulls the air in through the 
HEPA filter and past the Condensing 
Heat Exchanger (HX). The air passes 
over metal layers that are cooled by 
water from the Low Temperature 
Loop (see Chapter 11). When air hits 
the cool plates, the water condenses 
on a plate where it is drawn into 
small holes and separated from the 
air. The cooler and dehumidified 
air is then vented directly into the 
cabin. If the crew members want the 
air temperature to be warmer, they 
(or the ETHOS flight controllers) 


Why do we process the urine on the ISS 
instead of taking up fresh water? 

The basic answer is cost. Six crew members produce about 9 kg (~20 
lbs) of urine a day. About 70% of that, or 7.7 kg (17 lbs), is processed into 
water. In 2015, it cost about $25,000 to launch 0.5 kg (1 lb) of water to the 
ISS. This translates into approximately $425,000 of cost savings per day, or 
more than $155,125,000 a year in water that doesn’t have to be launched. 


can command the system to slightly 
close doors within the ducting of the 
fan, which reduces the amount of air 
passing over the cooler plates. For 
a cooler cabin, the doors are opened 
more fully, thus more air is passed 
over the plates. 

Since air is used to push the water 
into the collection holes, a mixture of 
water (-90%) and air (-10%) comes 
out the other side. The water enters 
a small centrifuge. As the centrifuge 
spins, the heavier water is pulled out 
from the air. The water is then routed 
to the condensate tubing where it can 
go either to a big condensate tank for 
storage or into the Water Processor 
Assembly (WPA). 


Water Recovery and 
Management 

As on Earth, water is a precious 
commodity in space and, therefore, 
is managed carefully by the flight 
control team. Water is transported to 
the ISS by one of the various cargo 
vehicles. The six types of water on 
the ISS are listed in Table 1. One of 
the key functions of ETHOS is to 
track the various quantities of water 
to ensure an adequate amount of each 
type. This section will discuss the life 
cycle of water on the ISS, which is 
depicted in Figure 5. 

As mentioned in the previous section, 
condensate water from the USOS 


Table 1. Types of Water in use on the ISS 


Type 

Use 

Potable Water 

Drinking water via the Russian systems for the crew containing a 
silver-biocide to retard microbial growth and minerals for taste. 

Technical Water 

Contains silver-biocide to retard microbial growth and is used 
for crew hygiene, Russian toilet flush water, and in the Russian 

0 2 generator to produce 0 2 . 

Condensate 

Water recovered from the atmosphere, which is processed back 
into potable water. 

Waste 

Urine or water that was used in the EMU (see Chapter 17). 

Special Fluid 

Water used for the internal cooling system or other uses, and 
which may contain chemicals to retard biological growth or 
chemical reactions and cannot be used for drinking. 

lodinated 

Similar to technical water but with iodine biocide; this type of 
water is used in the USOS water systems for toilet flush, the 

OGA, and, when stripped of iodine, the crew drinks it. 
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ARFTA - Advanced Recycle Filter Tank Assembly 

CCAAs - Common Cabin Air Assemblies 

CDRA - Carbon Dioxide Removal Assembly 

CWC - Contingency Water Container 

EDV - Russian Water Container 

EMU - EVA Mobility Unit 

OGA - Oxygen Generation Assembly 


ORU - Orbital Replacement Unit 
PWD - Potable Water Dispenser 
PWRs - Payload Water Reservoirs 
UPA - Urine Processor Assembly 
WHC - Waste and Hygiene Compartment 
WPA - Water Processor Assembly 
WSTA - Waste Storage Tank Assemble 


Figure 5. A schematic showing the overview of the water processing system. Wastewater from the Waste and Hygiene Compartment (WHC) is transferred to 
the Urine Processor Assembly and the WPA. From the WPA, clean water is placed on the potable bus where it can be transferred to the 0 2 generator, the crew’s 
drinking station (Potable Water Dispenser), or the Sabatier, or used for EVA Mobility Units or for flush water in the WHC. 


is collected in the WPA wastewater 
tank. If the WPA wastewater tank 
is not available due to a failure, the 
crew can configure some jumpers 
and send the water to be stored 
in a condensate tank. If the tank 


gets too full, it is possible for the 
ETHOS flight controller to open 
a series of valves and vent some 
of the water overboard; however, 
this is a last resort, as it results in 
loss of this precious liquid. The 


crew would offload the water into 
a Contingency Water Container 
(CWC) (Figure 6) prior to being full. 
The CWC is essentially a flexible 
bladder surrounded by fireproof 
fabric material that can hold about 
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Figure 6. A full CWC (left) and the “water wall’’ in Node 1 (right). Note that a CWC is about 61 cm (24 in.) long with a diameter of 24 cm (18 in.) and can 
hold about 43 liters (12 gal) of water. 



(Accumulates and stores brine for disposal) 


Figure 7. The Urine Processor Assembly schematic. Water comes from the waste storage tank to the Advanced Recycle Filter Tank Assembly and through a 
distillation process before gases are removed in the purge pump. 
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43 kg (-95 lbs) of water. Cargo 
vehicles such as the HTV can also 
deliver water using CWCs, which are 
then stored until they are processed 
by the WPA. Similar containers are 
available on the Russian side. 

Additional wastewater comes from 
the Urine Processor Assembly 
(UPA) (Figure 7), which receives 
input from the Waste and Hygiene 
Compartment (WHC). A crew of six 
generates about 9 kg (20 lbs) of urine 
a day. Using flush water, the WHC 
sends the urine to the UPA (solids 
are retained in a tank to be disposed 
of later). Urine consists mostly 


of water but also contains many 
organic and inorganic waste products 
including urea, chloride, sodium, 
potassium, and creatinine. The urine 
is treated with a chemical, called 
pretreat, to prevent the urea from 
crystalizing and potentially plugging 
the plumbing lines. A filter also 
removes any particulates that are left 
behind. Once in the UPA, the urine 
is pumped to the distillate assembly 
where the temperature is raised and 
the pressure is lowered to cause 
water evaporation. This evaporated 
water is compressed back into liquid 
form and is passed along to the 
WPA for further processing. The 


remaining fluid, called brine, is sent 
to the Advanced Recycle Filter Tank 
Assembly (ARFTA) where multiple 
filters pull out any particulates as 
the brine is sent back to the distillate 
assembly where it joins with more 
pretreat urine and more water is 
pulled out. 

The WPA is a key component of the 
water system on the ISS (Figure 8). 
First, water that is stored in the 
wastewater tank passes through a 
centrifugal pump called the Mostly 
Liquid Separator (MLS) similar to 
that used in the CCAA to remove 
air from the water. The water then 



Figure 8. Schematic of the WPA. Water is drawn from the wastewater tank and passes through a filter that separates gasses from the water since gravity 
isn’t present to facilitate natural separation. The water then passes through various filters including a heater to bake out impurities, a reactor to remove 
organics, and an ion exchange filter bed that will remove by-products of the organic reaction. Clean water is then stored in the product water tank. 
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Figure 9. Images showing OGA and the Water Recovery System racks. 


passes through a particulate filter, 
followed by the Multi-Filtration 
Beds, which removes nonvolatile 
organics and inorganics such as 
soaps and salts. The water then is 
purified more in a catalytic reactor, 
which oxidizes low-molecular- 
weight volatile organics (this process 
uses small amounts of the 0 2 that is 
stored in the tanks on the airlock). 
Next comes the gas separator, which 
removes gasses created during the 
oxidation process. This gas needs to 
be removed to avoid clogging the 
fine filters downstream that are used 
throughout the potable bus systems. 
This gas is returned to the cabin to 
be breathed by crew, thus preventing 
the waste of any 0 2 . Small amounts 
of iodine are added to the water 
to prevent microbial growth from 
occurring. This clean water is then 
output to the Product Water Tank 
where it can be fed to the potable 


water plumbing. Crews can extract 
water for drinking or rehydrating 
food via the Potable Water Dispenser 
(PWD) attached to this line. 
Wastewater from the UPA is also 
processed. People are often surprised 
that astronauts drink recycled urine. 
However, the processing is so good 
that what is left is virtually pure 
water. In fact, crew members have 
commented that the water tastes 
funny, which is actually a result of it 
being more pure than the water that 
is consumed on Earth. The OGA also 
uses the water from the potable water 
lines. The WPA can process 13 L 
(29 lbs) per hour. 

As discussed above, the OGA takes 
water and produces H 2 and 0 2 . Prior 
to the arrival of the Sabatier system, 
the H 2 was vented overboard. With 
the arrival of the Sabatier rack in 
October 2010, the H 2 would no 
longer be wasted. The rack takes 


H 2 and C0 2 and uses a catalyst at high 
temperature and pressure to produce 
water and methane via a chemical 
reaction first discovered by chemist 
Paul Sabatier. No further processing 
of the methane is possible on the ISS, 
thus it is vented overboard. 

Although water is processed in a 
nearly closed-loop fashion (i.e., 
little water is lost to the system), 
management of this process requires 
a lot of diligence by the ETHOS 
team. Various factors are always 
affecting the balance in the system. 
For example, some crews drink more 
water than others; individuals also 
perspire and urinate at different rates. 
If any of the systems experiences a 
malfunction, part of the processing 
loop stops and input backs up. 

ETHOS can also tune the system to 
adjust water balance. For example, 
the temperature for the Low 
Temperature Loop system can be 
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lowered, which decreases the dew 
point on the station and, in turn, 
causes more water to condense out 
of the air. Another option would be 
to raise the temperature to reduce 
the amount of water collected via 
condensation. If the condensate 
tank is full but the WPA is not 
operating, the crew can drain the 
tank into a CWC, which later can 
be transferred back to the tank 
when it is empty. The OGA uses 
water to generate 0 2 , which also has 
to be carefully balanced, thereby 
further complicating the process. 

The variables change often enough 
that water balance predictions are 
not accurate beyond 3 days in the 
future. Therefore, the ETHOS team 
must evaluate all these variables 
multiple times a day to ensure that 
the crews’ upcoming plan properly 
accommodates the water balance 
needs. The racks that make up the 
Water Recovery System and the OGA 
are shown in Figure 9. 


Emergencies 

In addition to maintaining life 
support, ETHOS must respond to 
emergencies. The three classes of 
emergencies on the ISS include fire, 
rapid depressurization (“depress”), or 
toxic chemical spill. 

Fire is a serious threat in space. In the 
event of a fire on Earth, one option 
involves quickly exiting a structure. 
By contrast, astronauts who live on 
the ISS can leave the station only 
as a last resort, given this results in 
the costly loss of vehicle utilization. 
Fire detection and suppression is 
part of the ECLSS. The first step 
in preventing fires is assuring the 
materials used on the ISS are fire- 
retardant. Strict rules are enforced 
to ensure the space station contains 
nothing that is highly flammable. The 
most significant way to mitigate fires 
in space is to make it difficult for 
one to start; however, if a fire should 
occur, being in space helps. Fires in 
space are also difficult to maintain, 
due to weightlessness. On Earth, 
convection (the process of lighter, 


warmer air rising while cooler gas 
falls due to gravity) can replenish the 
consumed 0 2 , thus allowing the fire 
to continue to burn. However, in the 
absence of forced airflow in space, 
convection is nonexistent; once the 0 2 
around a fire is consumed, the fire will 
extinguish. Therefore, electrical parts 
of the ISS are usually located behind 
panels where airflow is not possible. If 
a fire should start for some reason, it 
will likely extinguish itself. 

However, an electrical or chemical 
fire can still occur in a location such 
as a systems/payload rack or in the 
open cabin where there is regular 
airflow; therefore, the fire won’t 
quickly extinguish. As a precaution, 
smoke detectors are placed throughout 
the ISS to alert the crew and flight 
controllers to a fire, much in the same 
way smoke detectors are used as a 
precaution on Earth. The detectors 
on the ISS are similar to many in 
terrestrial buildings. Laser light is 
monitored to see whether particles 
of smoke are blocking the light 
(Figure 10). Once smoke is detected, 
the software will automatically 



Figure 10. Picture of a cabin smoke detector (left) and a schematic (right). Laser light bounces off of several mirrors into a photodiode detector. If particles 
of smoke are present, the beam will be obscured with a reduced brightness. Laser light will also scatter off the particles and into a second photodiode to 
ensure that a false alarm is not triggered by a single problem with the obscuration sensor. 
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annunciate a fire and sound the alarms 
throughout the ISS and on the ground 
in Mission Control. In addition to the 
smoke detectors picking up the event, 
if the crew sees or smells smoke, 
they can manually trigger an alarm 
via the caution and warning panel 
(see Chapter 5). When an alarm is 
annunciated, one of the first responses 
is for the software to turn off all fans 
and close the IMVs to help stifle the 
fire and prevent smoke from being 
transferred to other modules. 

If a fire is detected by the smoke 
detectors, the crew will need to 
quickly fight the fire. For a fire 
detected inside a rack, the crew can 
remove power to that rack instantly 
by throwing a switch called the 
Rack Power Switch. Astronauts will 
then use a long rod attached to the 
CSA-CP to measure the smoke within 
the rack for a period of time. If the 
CSA-CP readings hold steady or 
decrease, the fire is declared to be out. 
Readings that continue to increase 
means the fire is still ongoing and 
needs to be extinguished. In this case, 
the crew will use a Portable Fire 


Extinguisher (PFE)—i.e., an orange 
tank that contains about 2.7 kg (6 lbs) 
of C0 2 —and a long thin nozzle 
pushed through one of the small holes 
in the front of the rack to put out the 
fire. See Figure 11. By emptying the 
PFE into the rack, 0 2 is displaced by 
C0 2 , thereby depriving the fire of a 
critical component needed to bum. 

A wide nozzle that is installed on the 
PFE allows the crew to extinguish 
the fire in the event of visible flames 
inside the cabin. Smoke in the 
cabin can be dangerous to breathe; 
therefore, crew members will also don 
a Portable Breathing Apparatus (PB A) 
or a respirator (Figure 12). The small 
PB A tanks hold approximately 7 to 
15 minutes of 0 2 (depending on how 
well the mask fits to the individual’s 
face as well as the personal respiration 
rate of the crew member); however, 
the hose can be attached to an 0 2 
port within the USOS and can pull 
0 2 from the 0 2 tanks on the airlock, 
if additional time is needed. Since 
the time for a PBA is so short, and 
because 0 2 is also introduced locally 
near the fire, use of the respirator 


is preferable. Once the fire is 
extinguished, the flight control team in 
Mission Control assesses the recovery 
to clean the air. If few combustion 
by-products were created, they can be 
dissipated throughout the entire ISS 
volume and cleaned up via the TCCS. 
If large amounts of the by-products 
were created, the crew would set up 
a fan attached to a various filters to 
clean up the smoke and by-products. 
C0 2 from the PFE can be cleaned 
using the CDRA if the CDRA is in the 
same or nearby module. 

If sensors such as the PCA detect a 
decrease in atmospheric pressure, 
it is likely that the hull has been 
breached and the vital atmosphere is 
leaking out. In this case, the computer 
systems will annunciate a rapid 
depressurization emergency alarm. 
Alternatively, if the crew members 
feel their ears pop, they can initiate a 
manual rapid depressurization using 
the caution and warning panel. The 
crew will then follow the emergency 
response discussed below to locate 
and isolate or repair the hole. As 
crew members will be losing their 



Figure 11. PFE with rack attachment nozzle (left) and open cabin nozzle (right). 
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Figure 12. PBA (left) and respirator with fire cartridges (right). Different filters (orange boxes on either side) are attached to the respirator when it is being 
used after a fire or a toxic spill release such as ammonia. 


atmosphere, they can find themselves 
in a situation in which they do not 
have enough 0 2 to maintain cognitive 
brain functions. If this occurs, 
they will don a PBA and isolate 
themselves in their return vehicle to 
prevent suffering from hypoxia—the 
result of not breathing enough 0 2 . 

Toxic Atmosphere (ATM) represents 
the final emergency that the ECLSS 
supports, and which the ETHOS 
flight controller monitors. Various 
chemicals on the ISS are dangerous 
to the crew. Some of these chemicals 
range from mild irritants, such as the 
acid that can leak out of a damaged 
battery, to materials that can cripple 
or kill a crew member, such as the 


ammonia used for cooling. Except 
in the case of ammonia breaching 
the IFHX (see Chapter 11), there is 
no automatic annunciation of a toxic 
spill. The crew will detect it either 
from sight or from smell, and then 
annunciate the spill via the caution 
and warning panel. As was the case 
for fire, the IMV system is isolated 
to prevent the chemical from being 
dispersed throughout the ISS. 

Cleanup response to a toxic spill 
depends on what was spilled. 

All hazardous materials—i.e., 
HAZMATs—are logged into a 
database that lists the toxicity of 
every chemical used on the space 
station. Some are benign, but others 


can be extremely deadly. The flight 
control team and crew look at the 
database to determine the toxicity 
of the spill and the appropriate 
response. Basic response supplies 
are found in the Crew Contamination 
Protection Kit (CCPK). Mild spills 
can be cleaned up with wipes and 
silver shield gloves, which prevent 
absorption into the skin. Dirty wipes 
and towels are put in multiple plastic 
bags and carefully sealed to contain 
the material. In a bad spill, the 
crew members will don a respirator 
(Figure 12) and use the CMS to 
determine the air quality. For a really 
bad spill, the module might have to 
be closed off. 
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Emergency Response 

The previous sections outlined the 
basic equipment available to detect 
or respond directly to one of the 
three emergencies on the ISS—fire, 
rapid depress, or toxic chemical 
spill. However, these emergencies 
require time-critical responses from 
the entire crew and ground, and are 
heavily practiced by both. The initial 
response is similar for all three: 
warn others, gather in a safe haven, 
and work the emergency response. 

To warn others means to push the 
appropriate caution and warning 
alarm if an automated one has not 
been initiated. This process is critical 
to alert other crew members, but it 
also allows automated software to 
stop fans and close the IMV system, 
thereby reducing smoke or toxic 
gas from spreading throughout the 
ISS. Communication is also critical 
between the crew and ground. In 
the case of an emergency, both the 
Russian and NASA mission control 
centers spring into action. The crew 
is primed for responding to these 
emergencies, but the ground helps the 
crew as much as possible. 

Usually, the crew selects the location 
of the central post computer in the RS 
as the safe haven muster point. This 
is chosen because it is near the Soyuz 
vehicles, which might be needed for 
a quick evacuation if the situation 
is serious and cannot be resolved. 

If there are flames in the cabin 
between the crew and the Soyuz, the 
crew will create a safe haven away 
from the fire and then fight the fire 
as quickly and safely as possible. 
Crew members never want to be cut 
off from their escape vehicle. Once 


assembled, the crew will execute the 
appropriate response procedures, 
under the guidance of the commander. 
Generally, astronauts on the USOS 
use electronic procedures in English 
to perform their tasks, whereas 
cosmonauts use Russian procedures. 
However, emergency procedures are 
printed on paper—in what is called 
“the red book”—in case of computer 
or power problems. One page of the 
red book is in English and the facing 
page is in Russian so that any crew 
member can execute the steps under 
stress. One section of the red book is 
devoted each to fire, rapid depress, 
and toxic chemical spills. 

In the case of fire, the crew will 
begin by taking samples of the air 
in the safe haven with the CSA-CP 
to ensure the area is safe. Once 
safety is established, a team will 
usually go toward the fire, taking 
air samples along the way as the 
team prepares to identify and fight 
the fire. Crew members will don 
a mask if dangerous combustion 
products are detected. The crew 
will then try to locate the fire. This 
can be easy if smoke is visible; 
otherwise, the crew will have to look 
on the Portable Computer System 
Caution and Warning display for 
help (see also Chapter 5). Such help 
can include indications of an alarm 
from a smoke detector or from a 
system, such as a failed piece of 
equipment or a power trip. Power 
is shut down in order to remove the 
ignition source or in case the event 
is caused by an electrical short or a 
smoldering wire. Simultaneously, 
the ground controllers look at the 
same data to help vector the crew to 
a likely location. Once the location 


is identified, the crew will use a PFE 
to extinguish the fire, whether in a 
rack or in the cabin area. Using a 
PFE in an open cabin is a little more 
challenging in microgravity than 
on Earth: the spraying of the C0 2 
will act as a jet engine, propelling 
the crew member in the opposite 
direction if his or her feet are not 
anchored. The crew will close the 
hatches and seal the module while 
the ground figures out how best to 
clean up the smoke in cases where 
the heavy smoke will put the crew at 
elevated risk. 

The response to a possible 
depressurization event is initially 
the same. Once at the safe haven, 
crew members will estimate how 
much atmosphere is available. The 
US flight controllers have tools 
that tell them how quickly the air is 
escaping. The crew has access to a 
manovacumeter—i.e., a handheld 
device that shows the pressure in 
real time—that can be used by 
timing how quickly the pressure is 
decreasing. For holes so large that 
only minutes are available, crew 
members will evacuate to their Soyuz 
and prepare to depart. The ISS is 
about the size of a six-bedroom 
house, thus the hole would have to be 
very large to necessitate a departure 
by the crew. A hole that measures 
0.6 cm (0.25 in.) in diameter will 
cause the ISS to depressurize to 
the minimal atmospheric level for 
supporting human life (490 mm Hg, 
9.5 psi) in about 14 hours, whereas 
a 20 cm (8 in.) hole will reach that 
level in about 50 seconds. If enough 
time is available, crew members 
will look for the source of the leak. 
First, they will enter the docking 
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Figure 13. Schematic of the ISS showing all the hatches. In the initial response, each three-person crew gets into the combined Mini-Research Module 
(MRM) with its Soyuz and closes the hatch indicated by the arrows to check whether that area is leaking. If crew members still observe a leak, they will 
isolate themselves to determine the location of the leak within the MRM or Soyuz and prepare to either evacuate or re-ingress the ISS, depending on the 
results. Alternatively, if no leak is identified, crew members will enter the ISS (as represented by the dashed lines) and close the transfer compartment or 
Node 1 hatches (represented by arrows). At this point, the crew should know whether the leak is in the RS or the US Segment. Once isolated to a segment, 
the crew will close various hatches in a methodical process to isolate the module that is leaking. 


compartment attached to the Soyuz, 
close the hatch, and check the 
pressure to ensure the Soyuz itself 
is not leaking. Once the Soyuz has 
been deemed safe, the crew will 
move forward, dividing the ISS into 
sections and measuring the pressure 
to isolate the module that is leaking. 
For holes that are large enough, 
the pushing or pulling pressure on 
a hatch might clearly indicate the 
location of the leak. See Figure 13. 


If a hole is isolated to a specific 
module but cannot be seen, the 
crew can use an ultrasonic leak 
detector and headphones to move 
around inside the module to locate 
the specific spot by listening for 
the faint sound of air escaping. The 
crew can use a couple items to patch 
the hole, once the leak is found 
(see Chapter 3). The hatches to the 
module are shut in cases where the 
hole cannot be located or the amount 


of time before the crew would run 
out of air is too short. Eventually, the 
module will depress to a vacuum. 

Key systems may continue to 
operate, but anything that requires 
air for cooling or that is not rated to 
function in a vacuum (e.g., a laptop 
computer) will break and the ground 
flight controllers will power down the 
equipment in hopes that the module 
can be recovered and the equipment 
can be used again in the future. 
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The third emergency scenario is 
that of a toxic chemical release. In 
most cases, the cause would involve 
a chemical released from research 
equipment and would be cleaned 
up as described in the previous 
section. The most serious case is 
that of ammonia entering the cabin. 
This would happen if the IFHX (see 
Chapter 11) fails and the barrier 
between the outside ammonia and 
inside water breaks. In this case, 
poisonous ammonia would get inside, 
which can kill the crew in a matter 
of seconds. Once an ammonia leak 
is detected, the astronauts will don 
a PBA, remove any clothing since 
that could be contaminated, close 
the hatch between the two segments, 
and transition from the PBA to a 
respirator with ammonia filters. 

Since the IFHXs are located in the 
USOS, there is a good chance the 
RS will be safe. Shutting down the 
fans and IMV, which the software 
performs automatically when the 
alarm is initiated, will help prevent 
the ammonia from getting mixed 
into the RS atmosphere. Once in the 
RS, the crew will take a reading to 
determine whether the air is safe. 

If no ammonia is detected (i.e., 
ammonia concentration less than 
30 parts per million [ppm]), crew 
members may remove their masks. 

If ammonia is detected in the RS 
at a level less than 1000 ppm, crew 
members will wait a few hours for 
the ammonia to diffuse throughout 
the RS, thus reducing the levels to 
a safe limit. If the readings show 
high ammonia levels (>1000 ppm), 
crew members will enter their Soyuz 
spacecraft and begin cleaning its 
atmosphere, or prepare for a return 


to Earth. Since the Soyuz volume 
is so small, ammonia can be purged 
using the respirators. This is done by 
breathing in air through the filters of 
the respirator, thereby trapping the 
ammonia. If the Soyuz atmosphere 
contains too much ammonia 
(approximately 1200 ppm), the crew 
will not have enough filters to fully 
clean the Soyuz air and will have 
to quickly return to Earth. Note 
that these procedures will have to 
be updated when the commercial 
crew vehicles begin transporting 
astronauts to the ISS, mainly because 
the crew vehicles will be docked 
very close to the likely source of 
the ammonia—the heat exchangers 
in Node 2. Since this means the 
astronauts will have to pass through 
the highest concentrations of the 
toxic chemical to get to their escape 
vehicle, additional 0 2 tanks and a 
scrubber that can remove ammonia 
from the atmosphere will be stowed 
on the commercial spacecraft. 

Conclusion 

As the heart and lungs of the vehicle, 
the ECLSS allows crew members to 
focus on the important research they 
were tasked to perform. Emergency 
response is a priority on the ISS, as is 
maintaining a comfortable, productive 
environment in which humans can 
live and work. This effort requires 
a plethora of systems, subsystems, 
and experts to monitor and control 
all the elements necessary to not 
only survive, but also to thrive in the 
severe environment of space. 
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Chapter 20 Day in the Life: 

When Major 
Anomalies Occur 




Expedition 38 astronaut Rick Mastracchio participates in the second of two spacewalks needed to change out a faulty ammonia pump on the International 
Space Station exterior. 


Blockbuster movie themes often 
tell a story about a major obstacle 
that must be overcome, with 
several exciting plot twists and 
difficulties that make tackling the 
challenge even more interesting . 
Experts from many fields come 
together to solve a problem, with 
basic needs such as sleeping and 
eating all but forgotten in their efforts 
to accomplish a perilous undertaking. 
When the issue is solved at the end 
of the movie, the audience breathes a 
collective sigh of relief, and everyone 
feels an enormous sense of joy and 
pride in a job well done. 


Well, working in Mission Control 
sometimes feels like that! Along 
with the added bonus of occasional 
cheering and clapping. One dramatic 
human spaceflight example of this 
occurred when Mission Control 
saved the lives of the Apollo 13 crew. 
However, many extraordinary feats 
in the face of adversity have also 
occurred throughout the International 
Space Station (ISS) Program. 

Imagine sitting in Mission Control, 
performing normal tasks and 
looking at data when something 
unexpected happens. The displays 
do not look like they usually do. 


Warning messages in yellow and red 
splash across the screens, indicating 
issues with various systems. All the 
simulations come to mind, except 
this is not a simulation. This is really 
happening. The adrenaline kicks in. 
Time to figure out what happened and 
what can be done about it. 

At least one failure of some kind 
usually happens during each shift in 
Mission Control—sometimes many 
failures. Typically, these failures 
are relatively minor. For instance, a 
laptop computer might lock up and 
the team might have to try a few 
things to get it working again. Other 
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times, a failure may significantly 
alter the crew’s timeline for the 
day, as is sometimes the case with 
malfunctioning equipment needed 
for the task at hand. Or, the problem 
could be one that everyone dreads— 
an enormous failure that takes out a 
lot of the ISS functionality. 

The initial flight control team reaction 
could last anywhere from a few 
minutes to a few days. Sometimes, 
extensive troubleshooting is required 
to test various fixes or even to 
simply diagnosis the problem. Some 
issues need observation over time to 
determine what is wrong, some need 
the engineering designer’s advice, 
and some require complex ISS repairs 
that rely on the guidance of a large 
number of experts. 

This chapter outlines one (of 
countless) ISS failures, and the 
reaction from Mission Control. This 
major failure occurred in the ammonia 
system in December 2013. The 
failure took out a lot of ISS capability 
and required many days to repair. 

December 2013— 
Background 

Before discussing the failure, the 
anomaly recovery effort needs 
to be put in context. In 2012 and 
2013, the ISS Program had begun 
successfully launching two different 
types of commercial cargo vehicles 
as part of its move to commercialize 
transportation to low-Earth orbit. 

The competing vehicle types were 
the Space Exploration Technologies 
Corporation (SpaceX) Dragon and the 
Orbital ATK Cygnus (see Chapter 14). 
However, in late 2013, SpaceX was in 
the process of designing an upgrade 


to their Falcon launch vehicle, and 
commercial flights to the ISS would 
be limited for a few months to Cygnus 
cargo vehicles. Cygnus had performed 
a demonstration flight to the ISS; 
however, its first officially contracted 
cargo delivery was to launch in mid- 
December 2013. Orbital ATK was 
loading more than 1200 kg (2,645 lbs) 
of crew supplies, spare parts, research, 
and extravehicular activity (EVA) 
equipment. NASA wanted the cargo 
on the ISS, and Orbital wanted to 
fulfill its obligations and be paid for 
the flight. A period of “high beta” 

(see Chapters 7 and 9) was starting on 
December 30. During that time, the 
sun angle would not be favorable for 
solar array pointing needs and thermal 
effects on equipment such as antennas, 
which would result in the powering 
down of equipment. Docking during 
these phases is extremely challenging 
due to the limitations these constraints 
impose. Any slips to the Cygnus 
launch would need to skip over this 
period, placing the mission well into 
January, so managers were hoping its 
schedule would hold. 

One of the key problems facing the 
space station team at the end of 2013 
had to do with use of the spacesuits. 
The last US EVA in July 2013 had 
ended in a near fatality when water 
entered the spacesuit helmet of 
European Space Agency astronaut 
Luca Parmitano. The water covered 
much of his face and almost drowned 
him. After crew members performed 
some troubleshooting of the 
Extravehicular Mobility Unit (EMU), 
they determined that the water 
separator in the suit’s Primary Life 
Support System had clogged, thereby 
backing up water that ended up 
dumping into the helmet (see sidebar 
in Chapter 17, US Extravehicular 


Activity 23 Water-in-Helmet 
Incident). An official investigation 
was ongoing, and a root cause of the 
water separator clog had not yet been 
found. Something was contaminating 
the water system. If it was systemic 
in the water that was circulating 
inside the airlock, the source was 
possibly contaminating the entire fleet 
of spacesuits. After the incident, the 
EMU team designed an absorbent pad 
for the helmet interior that could be 
constructed by the crew on board, as 
well as a makeshift snorkel to allow 
for breathing from the body of the 
suit if water entered the helmet again. 
However, until the team found the 
source of contamination, the risk of 
drowning due to the same problem 
in any of the spacesuits was a real 
possibility for the crew. Engineers 
on the ground were in the process of 
assessing hardware from a previous 
mission and were seeing a complex 
water chemistry problem with no 
obvious cause. 

The plans on board the space station 
for the month of December 2013 were 
filled with science, Cygnus cargo 
transfer operations, and a Russian 
Segment EVA on December 20—but 
that was all about to change. 

“Orbit 2” day shift— 
Wednesday Dec 11,2013 

It was a “standard” Wednesday 
for the ISS operations team, just 
after 8 a.m. Central Standard Time 
(14:00 Greenwich Mean Time), 
about the middle of the crew’s day. 
The ground team was working with 
the crew in the airlock to get ready 
for installation of a new oxygen 
supply tank and were looking ahead 
to activities to prepare for the arrival 
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of the Cygnus cargo vehicle, which 
was scheduled to launch a week later 
(December 18). The Mission Control 
team was also preparing for an ISS 
reboost to a slightly higher altitude 
(see Chapters 7 and 8), so the team in 
Houston positioned a torn part of the 
Starboard Thermal Radiator Rotary 
Joint (TRRJ) to point away from the 
thrusters due to the forces generated 
when the thrusters fire during a 
reboost (Figure 1). 

As comes around every so often, 
a relatively routine action kicked 
off an unforgettable moment 
for those in Mission Control. After 
moving the radiator, the team 
noticed warning indications. 


Station Power, Articulation, Thermal, 
and Analysis (SPARTAN): “Flight, 
SPARTAN, I see the warning...” 

The flight controller in charge of the 
power and external cooling system, 
SPARTAN, announced the detection 
of an alarm to the team. 

SPARTAN and the team quickly 
determined the external cooling 
system Loop A had shut down and 
was no longer circulating fluid to cool 
about half of the equipment on the 
ISS (see Chapter 11, Figure 6). Loop 
A is one of two external cooling lines 
circulating ammonia via an external 
pump. Loop A circulates ammonia 
through the starboard radiator 
(the other string, Loop B, pumps 


fluid through the port radiator). An 
alarm sounded on board due to the 
significance of losing half of the 
external station cooling. 

Everyone in all Mission Control 
Centers quickly scanned their data 
and looked for the right procedures 
to address these questions: What 
caused the problem? Are temperatures 
starting to increase? What is the 
correct response to immediately “safe” 
(i.e., protect) systems? The ground 
team had to quickly diagnose the 
warning messages and determine what 
had caused the shut down since about 
half of the US On-orbit Segment 
ISS equipment was cooled by that 
loop and could start to overheat. As 



Figure 1. Torn sheet on the Starboard TRRJ. This TRRJ is usually pointed away from planned thruster firings unless the radiator needs to point in their 
direction for other reasons. The tear was first noticed in 2008. Since there is ample cooling, the sheet has not been repaired. 
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A failure that could become deadly! 


Some of the most critical interfaces on the ISS are 
called Interface Heat Exchangers, so named because 
of the ammonia cooling system and the internal water 
cooling system interface inside these units. The liquids 
do not mix; however, the design allows heat transfer 
from inside the ISS to outside the ISS. Heat is generated 
inside the ISS (e.g., from the many computers that run 
continuously). This heat warms up the water lines that 
circulate inside. At the surface of some key modules, the 
internal water and external ammonia lines come together 
in close proximity inside the heat exchangers, causing 
the internal heat in the water lines to transfer to the 
ammonia lines outside (some components outside the 
ISS are cooled with the ammonia lines). This ammonia is 
circulated externally to the radiators to “reject” the heat 
into space. See Chapter 11 for more system details. 

The ground team and the astronauts worry that these 
units will fail. If the ammonia inside a heat exchanger 
is cold enough and ice-like slugs form, a frozen area 
in the heat exchanger could break the thin barrier 
between the external ammonia loop and the internal 
water loop, causing high-pressure ammonia to enter 
the more-delicate water lines and rupture them inside 
the ISS, spilling toxic ammonia into the atmosphere 
(see Chapter 19 for emergencies). When an external 
ammonia loop gets too cold, as it did in December 2013 
when Loop A temperatures were low, flight controllers 
must carefully monitor temperatures and manage how 
and when a loop would be restarted. Fluid system 
experts and safety personnel also participated in the 
discussion over the 2-week timeframe of the Loop 
A repair to ensure safe loop operation relative to the 
Interface Heat Exchangers. (Figure 2.) 



Figure 2. (Top) One of two heat exchangers installed on US Lab (EVA 
access panel removed). This unit allows for heat rejection from the internal 
water loops to the external ammonia loops. Heat exchangers such as this 
one are installed on several modules under silver access panels, and they 
are mounted on the pressure shell. Water in the internal cooling loop is fed 
through the shell to the heat exchanger and flows in close proximity to the 
colder external ammonia cooling loop for heat transfer. (Bottom) Spare Heat 
Exchanger on the ground. See also Figure 2, Chapter 11. 


a smaller-scale comparison on Earth, 
imagine a car suddenly develops a 
problem with its radiator. The driver 
must determine when it is safe to 
pull over to the side of the road and 
turn off the engine to prevent it from 


overheating to the point of incurring 
damage. All of the ISS equipment has 
to be assessed quickly to determine 
what needs to continue operating for a 
while, due to its criticality, and which 
temperature-sensitive items need to be 


shut down as soon as possible. Flight 
controllers took immediate action to 
swap cooling sources for some critical 
equipment that could have overheated 
in a matter of minutes. They knew 
that loss of this loop would also mean 
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they would later have to prioritize 
which equipment could stay powered 
and which would need to be turned 
off to avoid over-taxing the remaining 
cooling loop with too much heat load. 

The SPARTAN on console in Mission 
Control saw that the software 
intentionally turned off power to the 
pump that circulates the ammonia 
because the ammonia was getting 
too cold. The radiator, which was 
rejecting heat, deliberately reduced 
ammonia temperature; however, 
various parts of the entire loop had 
to be tightly controlled, temperature- 
wise (see Chapter 11). A Flow 
Control Valve (FCV) controls how 
much of that cold ammonia from 
the radiator enters the primary 
system. That valve is located in the 
same external box as the pump that 
circulates the ammonia in the external 
lines. In this case, the FCV did not 
move properly. The valve should have 
been closed at that point; however, it 
was not. Thus, too much cold radiator 
fluid was entering the primary system. 

Within the hour, the flight control team 
restarted the pump and tried to control 
the FCV movement, but the loop 
remained too cold to flow ammonia 
through the heat exchangers that cool 
the internal water loops (see sidebar 
A failure that could become deadly!). 
The team continued to command 
the valve using various methods 
throughout the day, but to no avail. It 
seemed the valve indicated that it was 
in one position, but it was actually in 
another. The team moved the starboard 
TRRJ to a position that would warm 
it up, pointing at the sun and other 
structure; however, it still was not 
warm enough to allow use of the Loop 
A for cooling internal equipment. 

While the team was troubleshooting 
Loop A, they also had to ensure the 


most critical items received cooling. 
All of the powered equipment 
inside the ISS creates quite a bit of 
heat, and all of that heat was being 
put into Loop B rather than being 
dissipated into two loops. The team 
powered down equipment to reduce 
the overall amount of heat going into 
Loop B, and they also tried to get 
the Loop B port TRRJ fluid as cool 
as possible by pointing that radiator 
in a cold direction, away from the 
sun and structure. The Japanese 
and European module equipment is 
powered through Node 2, but one of 
the Node 2 internal loops could not be 
cooled. Therefore, some of the power 
to these modules had to be shut down 
to prevent overheating the Node 2 
electrical equipment. 

When the crew members’ day 
was wrapping up, they helped by 
performing some of the power-down 
steps that required their intervention. 
Some of the activities for the next 
day were already looking impossible 
to complete, due to lack of powered 
equipment. They were informed of 
some of the changes before they went 
to bed. Meanwhile, the ground team 
still had a lot of work to do, including 
performing the ISS reboost while 
working with a cooling problem. 

On top of that, the team received 
a caution that the reboost did not 
complete due to an unrelated issue, 
so they had to quickly verify that the 
ISS was in a safe orbit! 

The Mission Evaluation Room 
conducted meetings to involve the 
engineering team and they discussed 
what could possibly be done to correct 
the FCV problem. Meanwhile, the 
flight control team spent the next 
several hours trying unsuccessfully to 
move the valve, continuing to power 
down equipment and discussing what 


would happen if something else failed. 
More on that below. This is about as 
busy as the flight control team can get, 
and the flight director was trying to 
keep everything from getting worse. 

Thursday, Dec 12,2013 

By the next day, the magnitude of 
the situation was weighing heavily 
on not only the console team but 
also a much bigger team of thermal 
experts, visiting vehicle programs, 
EVA experts, scientists, international 
partners, and other space station 
stakeholders. Loop A was still 
actively flowing, but the FCV was 
unable to be driven out of its cold 
position. The ammonia was about 
30 Celsius degrees (54 Fahrenheit 
degrees) too cold. The team would 
either need to find a new way of 
warming up the ammonia in the 
loop, or have to perform a series of 
spacewalks to change out the valve. 

Warming up the loop would be a 
challenge, but the operations and 
engineering teams had some ideas. 
Options included tricking the FCV by 
telling it to move outside its normal 
limits, warming the lines via heaters, 
or trying to unconventionally use a 
different radiator valve to modulate 
the temperatures enough to allow for 
some heat exchanger use. 

Any of these “commanded from the 
ground” options would be desired 
over having to perform multiple 
EVAs. Spacewalks are risky and 
they require a lot of valuable crew 
time working with the spacesuits 
and tools. In this case, the time 
required for the EVAs to fix Loop 
A would probably mean the Cygnus 
mission would have to move to the 
following year. The spacewalks 
would entail change-out of a Pump 
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Calling in the Reinforcements: Team 4 

The operations team and the ISS Program management may determine that 
it is necessary to formally call together a larger-than-normal group of people 
to resolve a time-critical problem “off-console.” This type of team is called 
“Team 4” (see also Chapter 18), and it is led by a flight director. Team 4 is 
so named because it usually takes three shifts of teams to work 24-hour 
operations and an off-console team would be the fourth team. Although it 
implies a single shift of people, Team 4 usually requires two to three shifts 
over a few days to produce the required results. In the case of a Team 4 
call-up, all available resources are made available, including facilities and 
the Mission Evaluation Room engineering personnel, hardware providers, 
and contractors. The lead Team 4 flight director brings recommendations for 
risk- or cost-related ISS decisions to program management and keeps the 
ISS Program informed throughout the course of events. 

Since Team 4 is able to leave the flight control function to the other three 
teams, it can work on new procedures or perform analysis uninterrupted, 
work in mock-up facilities to determine what could be constructed on orbit, 
support the ISS Program meetings, or go try out spacewalk techniques in 
the Neutral Buoyancy Laboratory. Sometimes, members of Team 4 work 
together in a “War Room” setting, working in a dedicated conference 
room for hours each day with technical experts, discussing solutions or 
performing analysis. Team 4 is most successful when the console team is 
closely following the activities of Team 4. Team 4 creates official console 
documentation such as Flight Notes for new procedures and changes in 
the way the ISS should be operated. Team 4 members try to speak with the 
console team frequently throughout the day, and cell phones are always in 
hand in case console needs to reach someone on Team 4. 


Module, which is a large external 
box on the starboard truss that houses 
the ammonia pump and the FCV. In 
2010, the pump failed in a different 
way and was changed out via a series 
of three spacewalks. 

To avoid the EVAs, the team’s initial 
focus was on the “commanded from 
the ground” options. With the help 
of the Mission Evaluation Room 
members, the flight control team 
worked hard at characterizing the 
FCV failure and started to discuss 
other ways to control the loop 
temperatures. For example, they 
might be able to partially close a 
different valve—the Radiator Return 
valve—which would cause less flow 
from going to the cold radiator. 

The ISS Program management and 
Flight Director’s Office agreed that 
if these solutions were not looking 
feasible by morning, preparations 
for the EVAs would need to kick off. 
The chief of the Flight Director’s 
office named a flight director to 
lead the effort that would be called 
“Team 4” (see sidebar, Calling in 
the Reinforcements: Team 4). A few 
flight directors and some other key 
personnel met to start discussing the 
big picture in terms of personnel and 
EVA timing. 

One of the major tasks to discuss 
before starting to lead a big team 
was the timeline of events that 
would drive the deadlines for the 
team. December 30 through January 
8 was the high beta period, which 
would not be good for either an 
EVA or a Cygnus mission, due 
to additional power-downs of 
equipment. Squeezing in repair 
EVAs before December 30 would 
be difficult. Even more daunting 
would be squeezing in the EVAs 


plus a Cygnus mission with launch, 
rendezvous, capture, and berthing. 
The Russian EVA that was planned 
for December 20 would need to be 
renegotiated if a series of US EVAs 
was added to the schedule or the 
Cygnus capture happened to fall on 
that date. Even if a way was found 
to wedge two major events into 
the same day, two dynamic events 
(e.g., EVAs and visiting vehicle 
captures) are not typically planned 
on the same day due to overall 
crew and ground team workload. 


Friday, Dec 13,2013— 

Team 4 Is Called In 

The next morning, the console 
team continued to struggle with 
ground commanding to control the 
ammonia loop temperature. It was 
officially announced that a Team 4 
effort would be required to integrate 
all the teams and plan for EVAs. 

The Team 4 structure and logistics 
were discussed at a kickoff meeting. 
Several parallel efforts would be 
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occurring in various sub-teams, with 

seven key sub-teams listed below: 

■ £1445; Planning spacewalks to fully 
restore the system by replacing the 
degraded Pump Module with a new 
spare; this included writing down 
detailed steps to solve ammonia 
Quick Disconnect (QD) problems 
(connections in the system can 

be tricky) and planning for 
operations if the spacesuits become 
contaminated with ammonia 

■ Cygnus: Determining whether the 
Cygnus launch and berthing could 
be safely accomplished without 
Loop A fully restored, especially if 
the EVAs take a while to develop 

■ Troubleshooting: Continuing 
ground commanding to the system 
to see if temperatures could be 
controlled enough to allow for some 
temporary internal cooling, possibly 
allowing the Cygnus mission to 
occur before the EVAs, if needed 

■ EM Us: Continuing the investigation 
into what had caused the water 
separator to clog in an EMU, which 
spacesuit components would be 
best to use, and any other actions 
needed for the spacesuits 

■ Analysis: Predicting thermal 
and structural behavior of the 
systems with software modeling, 
known hardware performance 
and engineering experience; for 
example, predicting the behavior of 
the ammonia in the loop at different 
temperatures and pressures 

■ Planning: Planning the complex 
set of crew tasks and ground 
commanding sequence of events 
that would lead up to either a 
Cygnus-first scenario or an EVA- 
first scenario 


■ Next Worst Failure: Determining 
impacts to the ISS and actions in 
case of a “Next Worst Failure,” 
essentially planning for the worst 
thing that could happen next before 
the loop was fixed 

The EVA officer, robotics officer, 
and SPARTAN briefed the expected 
operations for the spacewalks. It 
was by no means already figured out, 
but the teams had already changed 
out a Pump Module in 2010 and since 
then the procedures and crew training 
briefing had been updated and were 
fairly current. 

The flight director leading Team 4 
announced the preliminary EVA 
schedule (should EVA be required) 
that had been sketched out on a 
whiteboard by the team the day 
before. The first spacewalk would 
need to be planned for December 19, 
just 6 days later, with the second and 
third EVAs occurring approximately 


December 21 and December 23, 
thus avoiding the high beta period 
starting December 30, and with the 
potential for three or more EVAs 
(Figure 3). This would leave a little 
bit of margin in the system if more 
time was needed between EVAs or if 
a fourth EVA was required. The EVA 
tasks that were involved are outlined 
Figure 3, assuming they could all be 
accomplished in three spacewalks. 

Normally, EVAs are planned over the 
course of months or years. Although 
a Pump Module was changed out in 
2010, several issues had occurred 
during the last change-out that would 
need to be resolved, and teams had 
estimated 16 days for the ground 
team and crew preparations needed 
to prep the suits and tools and study 
for the EVAs. Pulling it off in 6 days 
was difficult to imagine. With the 
holidays quickly approaching, many 
wondered whether they would be 
working instead. 


U.S. Spacewalks Overview 

EVA 1: 

• Set up 

• Degraded Pump Module preparation: Quick Disconnect (QD) 
demate, Pump Module Jumper install, electrical connector demate 

• Spare Pump Module preparation: Multilayer insulation (MLI) open 

EVA 2: 

• Remove degraded Pump Module, install on Payload ORU 
Accommodation (POA) 

• Install spare Pump Module - bolts and electrical connectors only 

EVA 3: 

• Finish spare Pump Module installation (Quick Disconnects) 

• Slow degraded Pump Module 

• Clean up 


Figure 3. This was the plan going into the series of EVAs. Astronauts would conduct three spacewalks. 
However, some tasks could take longer than anticipated; thus, the team understood that up to four 
spacewalks could be needed to complete the repair. 
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Figure 4. The spacewalkers: Rick Mastracchio and Mike Hopkins. Robotic arm operator: Koichi Wakata. 


Prior to launch, the Flight Operations 
Directorate and the ISS Program 
had determined who would perform 
spacewalks during the increment, 
if needed. In December 2013, the 
full six-crew-member team on 
board included US astronauts Rick 
Mastracchio and Mike Hopkins, 
Japanese astronaut Koichi Wakata, 
and Russian cosmonauts Oleg Kotov, 
Sergey Ryazanskiy, and Mikhail 
Tyurin. Prior to the mission, it had 
been discussed that if an EVA was 
required for an unplanned repair on 
the US Segment, Mastracchio and 
Hopkins would perform the necessary 
spacewalks and Wakata would 
operate the robotic arm (Figure 4). 

Cygnus Considerations 

The Cygnus mission was scheduled 
to launch in a few days; however, 
Team 4 and the ISS Program 
management had not yet finalized 
whether the mission could take place 


as planned or whether the ammonia 
loop needed to be working before 
Cygnus arrived. The health of the ISS 
would of course remain the priority, 
but until the decision to slip was 
required, the ISS Program wanted to 
keep their December launch options 
open. The ISS Program research 
team determined that the decision 
“need date” was a couple of days 
before launch day. The research group 
wanted to load the short-life science 
such as ants and a vaccine experiment 
into the Cygnus just prior to launch 
to ensure the science would last the 
entire mission. The Cygnus team had 
another couple of days to thoroughly 
consider their situation should Loop A 
not yet be repaired when they arrived. 
Among other things, the current loss 
of heat rejection from Node 2 meant 
that one of the two close-proximity 
communication units (see “Ship-to- 
Ship Communication Systems” in 
Chapter 13) between the ISS and 


the Cygnus would not be powered 
up. If the one unit that was powered 
had a problem during rendezvous, 
the Cygnus vehicle would abort as it 
approached the space station. Also, 
after berthing, half of the power feeds 
to the berthing mechanism on Node 2 
and half of the power feeds to Cygnus 
itself would not be available, thus 
exposing the mission and the ISS 
to bigger problems if the remaining 
systems experienced a failure. 

Next Worst Failure Concerns 

The overall state of the ISS was 
concerning. The ability to perform 
science was severely impacted since 
a lot of equipment was powered 
off. This was especially true in the 
Japanese and European research 
modules. Some critical-but-redundant 
items were not operational. For 
example, the United States On-orbit 
Segment (USOS) oxygen generator 
was not being used; therefore, the 
station relied on the Russian oxygen 
generation system for the time being. 
Also, any time the ISS is not in 
an expected configuration, a lot of 
little-used or not-yet-created analysis 
comes into play—e.g., whether 
cooling loops can handle more or 
less heat load, and how long some 
boxes can sit in a certain environment 
without overheating. 

To determine what level of risk the 
ISS Program was willing to accept 
and how quickly repairs needed 
to be performed depended on the 
answer to this question: “What is 
the worst thing that could happen 
right now?” These potential watch 
items were called the “next worst 
failures,” and some of them would 
put the ISS in a precarious position. 

A large team scoured the various 
scenarios, but the most significant 
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issue would be a subsequent failure 
of the Loop B pump (or failure of 
its power supply), which would 
cause a loss of heat rejection for all/ 
most internal components on the 
USOS. This would mean all of the 
computers, pumps, lights, etc., would 
need to be turned off. There might be 
some available limited capability if 
power could be supplied via jumpers 
(such as extension cords) from 
the Russian Segment and cooling 
ducts could be set up to blow air 
from the Russian Segment to keep 
US components from overheating. 
However, the Russian Segment was 
not designed to support six crew 
members or cooling of US equipment 
for long periods of time. Also, we 
would have to rely on a Russian EVA 
using Orlan spacesuits to change 
out components on the other end of 
the ISS if the USOS airlock had to 
be powered down. The team would 
be extremely handicapped if the 
previously designed spacewalks using 
the EMU and Space Station Remote 
Manipulator System (SSRMS) could 
not be used for changing out a large 
Pump Module. Waiting to fix the 
current problem meant spending more 
time at risk that a problem could 
develop with the second ammonia 
loop, and a repair in that situation 
would be much more difficult. 

Extravehicular Activity Decisions 

Some important decisions would 
need to be made over the course of 
the next few days. With a lot of open 
questions flying around, “collapsing 
trade space” was needed so that the 
team did not spend too much time 
performing unnecessary work. Trade 
space referred to risk assessment 
of the pros and cons for each of 
the options. Narrowing the options 
meant less work and a faster end 


result. In this case, the spacewalk 
crew members could spend a lot 
of EVA time stowing the degraded 
Pump Module neatly in a spot on the 


truss, or they could throw it out into 
space and let it bum up on reentry 
through the Earth’s atmosphere. Each 
option trades some risk to the ISS 


Figure 5. The degraded Loop A Pump Module was installed on the forward face of the truss on the 
starboard side of the ISS. The chosen spare was located on the External Stowage Platform #3, also 
on the starboard side of the ISS but below the failed pump (top). The going-in plan was that the two 
would eventually be swapped so that the degraded Pump Module would be placed on External Stowage 
Platform #3 (bottom). 
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Figure 6. This graphical representation shows how the EVA crew would be positioned when removing 
the large Pump Module from the truss. The crew member holding the Pump Module would have his or 
her feet in a foot restraint and would be holding onto the handrails in front. The Pump Module was very 
large and the crew members could not easily see around it while holding on. 


Figure 7. The crew would need to manipulate several interfaces on the Pump Module, including 
electrical connectors, bolts (“fasteners”), and fluid QDs, which open and close off flow to allow for 
disconnecting ammonia lines for the Pump Module change-out without fluid spraying all over the place. 


(e.g., What if the degraded spare 
could be re-used in some way later?), 
to the astronauts (e.g., What if water 
comes into the helmet again, and 
why were we unnecessarily spending 
time stowing this degraded pump?), 
or to the human population on the 
ground (e.g., What if the old pump 
does not fully bum up and a chunk 
hits a populated part of Earth?). The 
leadership reviewed the trades and 
worked to make decisions quickly 
so that the team could move forward 
with little wasted work. 

One immediate decision needed was 
which spare Pump Module would be 
used to replace the degraded pump. 
Three spares were stowed on the ISS 
exterior, none of which was in the 
same place as during the 2010 EVAs. 
That decision had to be made later that 
day or at least by the next morning 
since it drove the robotics (e.g., to 
drive where the Mobile Transporter 
or the SSRMS was to be located) and 
EVA procedure development. As it 
became apparent after looking into the 
situation, the procedure development 
would be simplified if one spare in 
particular was chosen, which made 
the decision fairly easy. The chosen 
location was a starboard stowage 
platform that was “hanging” nadir 
from the tmss (Figure 5). The location 
of the robotic arm also worked well 
for positioning one of the astronauts 
for the actual repair (Figure 6). 

Another key decision the team 
worked on for the next several days 
was how low the ammonia loop 
pressure could be allowed to get for 
the EVAs. When the Pump Module 
was changed out in 2010, the EVA 
crew had a difficult time working 
to disconnect and connect the large 
stiff fluid lines between the Pump 
Module and the tmss. As when filling 


a hose with water, higher pressures 
would make it more difficult for an 
EVA crew member to manipulate the 
lines. Lowering the pressure might 
significantly reduce the overall EVA 
time spent struggling with the QDs 
(Figure 7). In fact, if they struggled 


too much, another spacewalk might 
be required, adding crew risk of 
exposure to water entering the helmet. 
On the other hand, if the system 
pressure dropped too low, cold slugs 
of ammonia could move around and 
damage the heat exchangers, thereby 
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introducing the potential for lethal 
ammonia to leak into the crew cabin 
(see Sidebar: A failure that could 
become deadly!). 

A multitude of other decisions were 
going to be necessary. For example, 
several things went wrong on the 
last series of 2010 EVAs that were 
discussed in the standard post-event 
Lessons Learned meetings that now 
needed to be addressed, including one 
of the QDs that was stubborn on the 
last set of spacewalks. The crew had 
to literally bang on it with a heavy 
tool. What would happen if that 
technique did not work? 

New Extravehicular Mobility Unit 
Information 

The spacesuit teams received new 
data during the Team 4 effort, and 
they had to use this fresh information 
to sort out which spacesuit parts 
were the least likely to have clogged- 
up water separators if there was a 
problem with the water system of the 
entire fleet. The data were from some 
water filters that had been used on 
orbit, and they indicated that some 
filters were contaminated. These 
filters could have put particles in the 
system that made their way to the 
EMU water separator, creating the 
clog that backed up the water that 
spilled into the helmet. The EMU 
team started digging through the 
historical usage of those filters to 
determine which spacesuits had been 
exposed to those filters. 

Ironically, a spare water separator 
was being flown to the ISS. However, 
it was loaded into the Cygnus 
vehicle and would not be available to 
install into an EMU as a clean spare 
until after the vehicle arrived. This 
presented yet another item to consider 
when looking at the order of events. 


The Next 3 Days, 

Dec 14-16,2013 

Troubleshooting Team Progress 

The team at this point had turned 
its focus to trying to control the 
temperature of Loop A by partially 
closing off flow to the radiator using 
the Radiator Return valve. This 
valve is not intended to be stopped 
at incremental positions; however, 
the team members realized that they 
could start to move the valve and 
then remove power before it reached 
its final position with a goal to find a 
good partially open state for various 
temperatures. However, “fine” 
control this way would require new 
software to help with managing the 
temperatures through orbital day and 
night cycles and constantly changing 
internal heat loads. The initial short¬ 
term goal was to be able to bring 
the temperatures up high enough 
in Loop A to temporarily allow for 
the heat exchangers to be used for a 
couple of weeks. The team was on its 
way to doing so, but a large-enough 
temperature swing occurred and Loop 
A shut down again. The team was 
learning a lot about how to control 
the system, but it was becoming 
more and more clear that controlling 
the system with these techniques 
was just “buying time.” Eventually, 
the Pump Module would need to be 
replaced to keep the complexity down 
for operating the Thermal Control 
System. Unfortunately, as predicted, 
the thermal control experts were 
getting stretched very thin, working 
too many things at once. 

Cygnus Team Progress 

The Cygnus launch needed to slip 
for other reasons by 1 day, so it 
was announced that the mission 


would launch on December 20. 

This provided some relief for the 
team. The increment, Cygnus, and 
engineering teams were working on 
how to fly the mission by having the 
crew install power jumpers to the 
communication system and berthing 
system to provide redundancy 
during rendezvous and installation, 
respectively. Once the Cygnus was 
berthed, the crew would have some 
new cooling fluid jumpers that could 
be hooked up to provide internal 
cooling for the power distribution 
boxes. Parallel planning for the 
Cygnus mission and the EVAs were 
going to come to a decision point 
around Tuesday evening. The crew 
and ground would begin operations 
that would be needed for either EVA 
or Cygnus and would preclude the 
other (e.g., moving the SSRMS to 
support the EVAs was required on 
Wednesday; jumper install for Cygnus 
occurred on Wednesday). These 
operations could possibly be pushed 
back a day or two, resulting in a delay 
in one of the operations; however, the 
loss of days in the increasingly tight 
window of opportunity this month 
was a concern. 

Extravehicular Activity and Analysis 
Team Progress 

The team uplinked preliminary 
procedures for the crew members to 
study, and they started getting the 
suits ready. The crew members got 
way ahead in their work, which kept 
the work that the ground teams had to 
complete as the long pole in the tent 
in terms of schedule. 

To answer the question about whether 
a low ammonia line pressure is 
required for EVA crew manipulation 
of the lines, a team of EVA specialists, 
ammonia line experts, and astronauts 
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Figure 8. Astronaut Doug Wheelock is testing fluid QDs at varying line pressures to determine 
which pressures make it too hard for the spacewalking crew to perform the task. Doug had performed 
a similar task while on a spacewalk in 2010, so he was the natural choice to perform the testing. 

A harness allowed his body to move left and right when he put in forces on the connectors, somewhat 
simulating the way it would be in space. 


tested QDs at various pressures to 
determine how much pressure it 
would take to make it too difficult 
for the EVA crew member to perform 
the necessary line movements, 
disconnections, and reconnections. 

The team designed a test with an 
astronaut in a sling hanging from the 
ceiling of a large high bay to try out 
the manipulation as if he were in zero- 
gravity. The team wanted to know 
how much his body moved around 
when he was tugging and pushing on 
stiff ammonia lines. The problem with 
this decision is one often faced with 
spaceflight in that it has to be based on 
inexact testing and analysis. It would 
be ideal to have the microgravity, 
vacuum, and thermal conditions at 
which the ISS is flying to understand 
how the hardware actually moves, 
However, the test subject would need 
to be in space for that to occur. The 
terrestrial test is shown in Figure 8. 
The Neutral Buoyancy Laboratory—a 
large swimming pool for EVA 
training—could not be used since the 
high-fidelity lines and QDs, of which 
there are precious few in existence 
on the ground, would corrode in 
the water, thereby resulting in an 
inaccurate reflection of the forces and 
actions that astronauts would have to 
take in space. 

The teams also pulled out real 
emergency gas masks and tested out 
how they could transition a crew 
member in a water-soaked EMU 
helmet to an emergency mask in 
the event ammonia contamination 
on the spacesuit is released into the 
ISS atmosphere after the spacesuit is 
inside. Water attracts the ammonia, 
so after repressing the airlock, the 
spacewalking crew member would 
close his or her eyes while an 
assisting crew immediately removed 
the EMU helmet, wiped the crew 


member’s face, and applied the 
emergency mask. One of the more- 
difficult decisions would be whether 
to hurry the crew members inside or 
have them wait longer at vacuum. 
When water in the helmet is not a 
concern, the ground would normally 
instruct the contaminated EVA crew 
members to stay at vacuum, letting 
any stuck-on ammonia “bake off’—a 
term that describes the sublimation of 
solid ammonia to vapor, which would 
effectively result in contamination 
lifting away from the spacesuits. If a 
crew member has water in his or her 
helmet, this might be more urgent 
than the ammonia contamination 
issue if the water moves onto the 
astronaut’s face. The worst case 
would be an astronaut who has 
ammonia contamination (which is 
fairly common) and water leaking 
into the helmet (which was thought 
to be more likely to occur if the water 
system was contaminated). Each case 


might dictate a different response, but 
the team did its best to generalize and 
write down actions that could be used 
for quick decision-making for the 
different situations. 

The concept of jettisoning the 
Pump Module (i.e., throwing it into 
space, where it would eventually 
deorbit and bum up in the Earth’s 
atmosphere) was one of those 
concepts that by Monday needed 
to either be pursued as the primary 
course of action or dropped as a 
concept. It was requiring a lot of 
work in parallel with a non-jettison 
option. Multiple team members 
came to the Team 4 meeting that day 
with good information and analysis 
related to jettisoning the degraded 
Pump Module. The latest trajectory 
analysis with new data showed that 
because of the mass, diameter, and 
external shape of the Pump Module 
and the various ways it could be 
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thrown by the EVA crew, it would be 
difficult to ensure the Pump Module 
would not come around and hit the 
ISS on a future orbit based on orbital 
mechanics. Also, it would need to be 
thrown in a direction that the EVA 
team thought would be tricky for the 
crew members, given the position 
of having their feet in the SSRMS. 
Reasons for keeping the degraded 
Pump Module were also surfacing in 
that the engineering team had been 
brainstorming ways to repair it in 
the future. So, the team turned off all 
work on jettison as part of a nominal 
course of action. Contingency 
jettison would still need to be worked 
in case a spacesuit emergency came 
up while the crew was holding the 
Pump Module. 

Tuesday, Dec 17,2013— 
Decision Day 

The Radiator Return valve effort 
was not looking as promising as 
the EVA effort, so the ISS Program 
management decided to commit 
to performing the EVAs. Because 
there was risk to the Cygnus mission 
with Loop A unable to control 
temperatures, the ISS Program made 
the decision that the EVAs would 
occur first and the Cygnus mission 
would launch in January so that 
it would arrive after the high beta 
cutout. A fresh complement of ants 
and vaccine-related science would be 
loaded into the vehicle just prior to 
that January launch. 

At this point, a decision needed to 
be made regarding when the team 
would actually be ready for the first 
EVA. One key area in the “trade 
space” of the schedule was the issue 
of which spacesuit components 


would be worn by the crew and how 
much time it would take to get them 
ready. Over the course of the previous 
few days, the team looked at which 
spacesuit components had been 
exposed the least to contaminated 
water filters over the past few 
months. Ironically, the Primary Life 
Support System (PLSS) used by 
Parmitano (designated “3011”) had 
recently had a lot of components 
changed out due to the investigation 
of the water in the helmet. With all 
of its new spare parts, PLSS 3011 
was actually considered one of the 
cleanest (i.e., not as contaminated), 
and one of the recommended 
spacesuit parts to be worn for the 
EVAs to recover Loop A. 

However, use of 3011 would require 
another 2 days to get the suit ready, 
which would push the first EVA to 
Saturday, December 21. Unlike the 
other recommended spacesuit, a 
spacesuit using PLSS 3011 would 
need to be resized using different 
modular parts to fit the current crew 
on board and change out of some of 
the components. The Hard Upper 
Torso and Secondary Oxygen Pack 
would need to be removed and 
replaced (see also Chapter 17). Hard 
Upper Torso sizing changes drive 
other changes, sometimes causing 
the need for different legs for the 
arms and legs, and the new parts 
and tweaks take time to put together. 
Despite the fact that a delay in the 
EVAs meant extending the risky 
posture of the ISS, the team agreed 
that these modifications and the use 
of that suit was the right thing to do to 
reduce the risk to the on-board crew. 

The teams working the crew schedule 
and EVA were relieved to have 2 more 
days and a single, manageable plan. 


Working Out the Extravehicular 
Activity Details 

As for the EVAs themselves, the team 
continued testing and finalizing the 
details. Some of the EVA issues that 
had to be addressed throughout this 
effort are shown in Table 1. 

An EVA team performed a test in 
the Neutral Buoyancy Laboratory 
to verify each crew member would 
be able to get back into the airlock 
quickly from each of the planned 
worksites in the event of another 
water-in-helmet scenario. The 
scenario is tricky since it combines 
several already-hazardous areas 
of spacewalking—turning off the 
water shuts off the cooling fan so 
the astronaut’s body might literally 
overheat; taking steps to prevent 
overheating involve purging the 
oxygen in the suit, which significantly 
increases the risk of running out of 
oxygen. The team walked through 
the scenarios for these specific 
locations and to determine whether 
the crew needed help getting back 
to the airlock. Crew members had to 
get to the airlock approximately 30 
to 40 minutes after the emergency 
was declared, depending on how 
much energy they were expending 
and how hot they might get (e.g., 
if they are “riding” on the SSRMS, 
or working harder by using their 
hands to translate). Mission Control 
simulations such as those described 
in Chapter 10 were also planned— 
i.e., a water-in-helmet case, along 
with ammonia contamination and 
simulating what would happen if a 
Next Worst Failure occurred. 

Also, the team began to discuss what 
would happen if the EVAs were 
not complete on time and whether 
an EVA would be needed to finish 
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Table 1 . Examples of the Bigger Issues that Reguired Resolution by Team 4 


# 

Questions, Issues 

Method for Resolution 

Final Conclusion 

1 

Which of the three spare pump 
modules should be used? 

Determine whether any are considered better 
spares based on their history; look at ease 
for robotics and EVA to access each of them. 

Use spare on External Stowage 

Platform #3 on the starboard nadir 

truss. 

2 

Which spacesuit components are the 
safest to use (i.e., the least likely to 
cause water to enter the helmet)? 

Look at the history for the components and 
choose the components that seem to be the 
least-contaminated. 

Use PLSS numbers 3011 for Hopkins 
and 3010 for Mastracchio. 3011 use 
requires additional time for sizing and 
component changes. 

3 

Can the crew get back to the airlock 
safely if there is another water-in- 
helmet scenario? 

Perform a test in the Neutral Buoyancy 
Laboratory to verify each crew member 
would be able to get back into the airlock 
quickly from each of the planned worksites. 

Both crew members would be able to 
get to airlock in the required time from 
different places on the ISS 

4 

What will the team do if water enters 
the helmet, therby necessitating 
quick airlock ingress, but the crew is 
contaminated with ammonia? 

Write down expected responses based on 
the severity of the water or the severity of 
the contamination. Perform a test with a 
real emergency mask and EMU. Perform 
a simulation of such an event in Mission 
Control. 

Test and simulation were instructive 
and procedures were created as a 
result. The final procedures were sent 
to the crew and published on the 
ground. 

5 

Should we jettison the degraded 

Pump Module or spend time putting 
it back in a stowage location? 

Determine the ISS risk for jettison based 
on the potential for re-contact of the Pump 
Module with the ISS; determine the ease for 
the EVA crew to perform the jettison and EVA 
time it would save; determine future use for 
the degraded Pump Module, or whether 
it can just burn up in the atmosphere on the 
way down to Earth. 

Jettison risk and complexity too high; 
decision made to stow the Pump 

Module and only jettison in case of 
quick crew emergency that would 
necessitate it. 

6 

Which ammonia loop pressure 
should be used—a very low pressure 
to help the EVA crew’s work or 
a higher pressure to ensure the 
ammonia does not form pockets 
of vapor that could break the heat 
exchangers. 

Perform testing with previously flown 
astronauts to determine which line pressures 
are acceptable. Have ammonia and safety 
teams analyze pressures that could result in 
heat exchanger damage. Choose a pressure 
that is acceptable to both, and best balances 
the risks. 

Agreed on middle-ground pressure 
that would avoid concerns about heat 
exchanger damage but was a little 
more challenging for the EVA crew. 

7 

What if more EVA planning or 
execution time is needed, and an 

EVA slips into the high beta period? 

If this happens, weigh the risk of the ISS 
situation at hand (with a Pump Module 
partially installed) against the risk of high 
beta (not having much power and thermal 
issues that might take down critical items 
such as video). 

EVAs did not slip into the high beta 
period; therefore, no risk trade was 
required. 


Pump Module installation during 
the high beta period that started 
December 30. The team was worried 
that the solar arrays would not be 
able to generate enough power 
where they would have to be placed, 
that external boxes would heat up 
too much, and that the Ku antenna 


(see also Chapter 13) that supplied 
critical video during the EVAs would 
not be usable. 

Two key decisions were made this 
day. The team would not know 
whether those decisions were good or 
bad until the EVAs were in progress. 
First, the EVA team had requested 


the lowest possible line pressure 
to allow the EVA crew to perform 
operations with the fluid lines and 
QDs. However, the risk was that at 
low pressures below 12,412 mm Hg 
(240 psi), ammonia vapor could form 
near the interface heat exchangers 
(see sidebar: A failure that could 
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become deadly!). When the loop 
would be pressurized back to normal 
temperatures, a cold, “icy” slug of 
ammonia would move into those 
areas of vapor and freeze the interface 
heat exchangers, thereby breaking 
the heat exchanger and pushing 
toxic ammonia into the crew cabin. 
After much discussion, the team 
agreed to an ammonia line pressure 
that was a compromise reduced 
pressure of 9,309 mm Hg (180 psi) 
that would make it easier for the 
spacewalking crew manipulating 
the QDs but keep the loop pressure 
high enough to avoid too much 
vapor in the lines. The team would 
not know whether the pressure was 
low enough for the EVA crew until 
they were out on the spacewalk, and 
the pressure would take too long 
to be lowered, real-time, during 
the spacewalk. Therefore, another 
EVA would likely have to be added 
if the decision was conservative. 

The other key decision had to do 
with how much testing would be 
done after the new Pump Module 
was installed. Ideally, the new 
pump would be checked out before 
the Pump Module (which did not 
contain any ammonia) was filled with 
ammonia from the tanks. The team 
did not want to waste the ammonia 
if for some reason the Pump Module 
that was installed would not work. 
However, because a real-time test 
would delay the EVA crew’s work, 
the decision was made that the test 
could be skipped if it looked as 
though other critical work could not 
be completed in time to fully close 
out the last EVA. 


Wednesday - Friday, 

Dec 18-20,2013 

With the exception of the EMU 
team that had to work on readying 
PLSS 3011, the members of the 
bigger team felt as though they were 
given a gift with two additional days. 
This meant they could focus on really 
dotting the i’s and crossing the t’s 
on the plan, and then get some rest 
before the first EVA. By this point, 
the team was very tired. When there 
is a problem and the dedicated folks 
in Mission Control need to solve it, 
they often spend 12 or more hours a 
day working the issue (and sometimes 
many more hours), and it can feel like 
finals week in school. 

On Wednesday and Thursday, the 
ground team finalized the procedures 
and the crew readied the suits, tools, 
and themselves. It is difficult to 
even imagine the number of tools 
required to go out with the crew— 


approximately 40 tethers were needed 
to hold the equipment onto the crew 
and the ISS (Figure 9). That number 
does not even include the tools needed 
to do the actual work. Multiple bags 
full of tools, as well as individual 
tools, were tethered all over the suits. 
Some of those tools were to be used 
in the EVA, and some were backup 
tools in the event the original tools 
encountered problems. Some of the 
tools were needed specifically for the 
difficult QDs for the ammonia system. 
The crew members were sent video 
on their operation. They practiced 
their use inside, and they had video 
conferences with their instructors 
to prepare for the use of these 
specialized tools. 

Not all of the work is technical. 
Another task for the team is to 
support press conferences to brief the 
media about what is planned during 
spacewalks. Ideally, this would not 
take much effort since the technical 



Figure 9. View of Rick Mastracchio during EVA 25. Several tethers can be seen on the front of his suit, 
with the cinch straps floating in various directions. These tethers are for general purpose use to attach 
equipment to the ISS structure, and equipment to his spacesuit tool caddy on his chest. A small, round 
trash bag is also visible. 
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Figure 10. A press conference held December 18, 2013, prior to the first spacewalk. From left to 
right: NASA moderator Josh Byeriy, ISS Program Manager Mike Suffredini, Flight Director Dina Contella, 
and Lead EVA Officer Allison Bolinger. 


issues that were resolved and 
what will be done on the EVA had 
been summarized. However, some 
overhead in preparing is needed to 
frame the situation for the public, just 
as any presentation takes some work 
(Figure 10). 

An ISS Mission Management Team 
(IMMT) meeting was held on Friday 
to determine the readiness to proceed 
with the spacewalks (aka, a “Go or 
no Go” poll). 

The Team 4 lead flight director briefed 
the IMMT on all the completed work 
and conclusions they had reached, 
and the international partners and 
representatives from all of the key 
organizations reported on their 
readiness and agreement. The IMMT 
then decided how to proceed forward. 

The EVA timeline of events was 
ready to go. Mastracchio would “ride 
the arm” (i.e., put his boots into a 
foot restraint on the robotic arm) and 


be the one to work with the difficult 
fluid QDs. If the QD operations went 
smoothly, he could move on to tasks 
planned for the second spacewalk 
to remove the massive failed Pump 
Module and temporarily stow it on 
the Mobile Remote Servicer Base 
System. Hopkins was going to “free 
float,” moving himself by grasping 
handrails and assisting Mastracchio. 
Wakata was the primary robotic arm 
operator, with Kotov helping him at 
the Robotic Workstation. 

As the EVA approached, a concern 
surfaced that the Interface Heat 
Exchanger for the Columbus 
module (similar to the Lab version, 
shown in Figure 2) might have been 
accidentally exposed to freezing 
temperatures that could result in 
an ammonia leak into the internal 
thermal cooling system after 
activation of the new Pump Module 
during repressurization of the external 
loop. The concern was raised based 


on thermal analysis, not actual 
temperature telemetry, so the team 
was trying to work through whether 
this was a real concern or if something 
was slightly wrong or overly 
conservative in the analysis. The team 
was also working on a Loop A repress 
procedure that accounted for this 
potential problem with the Columbus 
heat exchanger. However, everyone 
agreed that a solution would be found 
and the EVAs should continue. 

The ISS Mission Management 
team agreed on Friday morning that 
everything was ready and the team 
was Go for the EVA on Saturday. To 
prevent fatigue during the critical 
EVAs, almost everyone working in the 
control center for Saturday’s EVA was 
encouraged to take Friday off to rest. 

Saturday, Dec 21,2013— 

The First EVA (ISS EVA 24) 

The moment had arrived for the 
first EVA. The night before, the 
lead EVA officer and flight director 
for the spacewalk marked up their 
procedures with notes such as 
“discuss EMU consumables” at 
various points, to agree in advance 
how often they would make standard 
calls and generally study what 
information exchange would be 
necessary. The team was fairly well 
rested and ready to go. 

The crew worked efficiently 
that morning in “EVA prep” and 
prebreathe, with Wakata and Tyurin 
helping to suit up Mastracchio and 
Hopkins and allow them to purge the 
nitrogen from their blood by breathing 
pure oxygen before depressing the 
airlock (see Chapter 17). The EVA 
crew members tethered themselves 


DAY IN THE LIFE: WHEN MAJOR ANOMALIES OCCUR CHAPTER 20 


369 






Figure 11. Koichi Wakata, representing the Japan Aerospace Exploration Agency, is shown “driving” 
the SSRMS at the Robotic Work Station in the US Laboratory during one of the EVAs. 


in the small crewlock, Wakata shut 
the hatch between the crewlock 
and equipment lock, and the crew 
performed a crewlock depress to 
vacuum. They opened the hatch 
around 6:00 a.m. Houston local time, 
about 10 minutes earlier than planned. 

These types of events are a big 
deal in Mission Control, with 
photographers and, in this case, a 
videographer walking around in the 
room. The excitement in the crew 
members’ voices could be heard as 
they experienced a spacewalk “live.” 
Their helmet camera views as they 
looked at the Earth and took photos 
of each other could be seen. Their 
time in the spacesuit was limited— 
they would deplete their suit of 
consumables and be very fatigued at 
the end of the day—so every minute 
counted. The team in Mission Control 
was hypersensitive of time, since 
they might have the opportunity to 
get ahead on this first spacewalk and 
actually pull the Pump Module out of 
the truss to temporarily stow it. That 
would mean the new Pump Module 
could be installed and working with 
only one more spacewalk. Due to 
all the training and preparation, the 
flight control team might appear calm 
to the casual observer. However, 
everyone is on high alert and is 
highly vigilant. Figures 11, 12, and 
13 show the crew and flight control 
team working the EVA. 

A few curve balls were thrown at the 
crew and Mission Control during the 
spacewalk with respect to the tools, 
the Pump Module and its QDs, the 
spacesuits, and other space station 
items. For example, a foot restraint 
was difficult to remove from the 
location where it had been stowed 
for quite some time in the harsh 


space environment, but it eventually 
came free. Also, some of the fluid 
QDs (Figure 7) were difficult to 
manipulate, and one of them leaked 
a small amount of ammonia. This 
leak looked like floating snowflakes 
bouncing off of both spacesuits. 


This occurred early enough in the 
spacewalk that the crew was outside 
a long time after this point, giving 
the ground team confidence that any 
ammonia had baked off. The flight 
director at the end of the EVA waived 
the Flight Rule that indicated a test 
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Figure 12. The ISS flight controllers during the first spacewalk to repair the faulty Pump Module. From Left to right: videographer, Flight Director Dina 
Contella, CAPCOMsAki Hoshide and Doug Wheelock, and Lead U.S. EVA Officer Allison Bolinger. 


should be done in the airlock to 
check for ammonia, due to the small 
quantity of flakes, length of time the 
ammonia had been “baking off’ the 
spacesuit, and history with these test 
results in similar conditions. 

The spacesuits generally performed 
well; however, at one point, Hopkins 
noted that some of the outer layer of 
material was missing from his left 
glove (see also Figure 6, Chapter 17). 
The ground team discussed the 
situation and the Flight Rules that 
govern glove damage and decided that 
the EVA could continue because the 
underlying bladder-protecting material 
had not been damaged. The outer 
layer was for better grip of the tools 


and handrails, but the parts of the suit 
that held its shape and kept oxygen 
from leaking out were still intact. 

The ISS also happened to experience 
some unrelated failures during the 
EVA. For instance, a smoke alarm 
rang on board the ISS. The ground 
team and crew had to quickly re¬ 
prioritize what they were working 
on so that a potential fire could 
be discussed. The EVA crew 
members and their work were 
frankly lower priority than any 
possible fire. However, this smoke 
alarm was determined to be a false 
smoke indication in the Service 
Module. The smoke detector was 
set off when the crew kicked up 


some dust while cleaning. Another 
unrelated failure occurred with 
the Carbon Dioxide Removal 
Assembly, which had to be manually 
restarted by ground command after 
a failure. These sorts of surprises 
kept the flight control team on edge. 
Thanks to similar training during 
simulations and similar failures seen 
in the past, the team was able to 
work through them fairly quickly and 
continue the spacewalk. 

The entire team, including the 
seasoned crew, did very well that 
day, and there was time to pull the 
degraded Pump Module out of the 
truss and temporarily stow it in a 
designated location on the Mobile 
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Figure 13. Expedition 38 Flight Engineer Rick Mastracchio, as seen behind part of the degraded 
Pump Module that was removed from the SI truss during EVA 24. He is temporarily stowing the Pump 
Module by guiding it to be grasped by its grapple fixture by a robotic end effector that is housed on the 
Mobile Remote Servicer Base System. 


Transporter. By anticipating all of 
the critical decisions, and because 
nothing serious had happened, the 
team was able to actually get ahead 
of the planned schedule. That was 
half the content of the next EVA. 


The team in Mission Control was 
excited to be this far along in 
repairing the space station. The EVA 
ended after 5 hours and 28 minutes. 

After repress, one of the spacesuits 
had its water switch inadvertently 


flipped to the “on” position for 1 to 
2 seconds, causing water to flow into 
the sublimator when not at vacuum. 
The switch is normally protected with 
a “guard” to prevent bumping. In this 
case, the guard had yet to be installed. 
The EVA experts were worried 
that the sublimator would become 
damaged during the next EVA, since 
pockets of water that would not be 
able to evaporate in time might cause 
uneven freezing after airlock depress, 
thereby warping or cracking the 
sublimator. Mission Control had the 
crew open the flap on the EMU to 
allow for dry-out. The team realized 
it would be impossible to tell, before 
the next EVA, whether the sublimator 
would be acceptable since water 
could be hidden from the crew’s view. 

The team quickly concluded that this 
suit could not be used, and had to 
choose from the on-board complement 
of modular suit components available. 
It was decided to resize PLSS 
3011 for Mastracchio and then use 
a new suit sized specifically for 
Hopkins. This resizing had to be 
done before the next spacewalk. 

Sunday and Monday, 

Dec 22-23,2013 

The next EVA (EVA 25—the 25th 
increment spacewalk during the 
program) was originally intended 
to occur on Monday, December 23. 
However, with this additional suit 
resizing and given that the team 
had possibly reduced the number 
of EVAs from three to two, EVA 25 
was moved to December 24. The 
crew and ground team slept in a little 
on Sunday, worked on suit resizing 
and changing tools, and generally 
preparing for EVA 25. Until that 
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Figure 14. Astronaut Mike Hopkins rides the robotic carrying the 354-kg (780-lb) ammonia Pump 
Module as the ISS flies over South America. 


point, everyone had been focused 
on the first spacewalk. Now, that 
same level of attention and diligence 
was needed to safely complete the 
job. The flight controllers and the 
engineering team provided their 
final approvals for the procedures 
to be used on this EVA, and the 
crew went to work studying these 
procedures and gathering the tools 
needed. The flight control team had a 
brief tag-up in a conference room in 
Mission Control on Monday to make 
sure everyone was well versed on 
the robotic arm movements, system 
changes, and EVA procedures. 

Another issue related to hydraulically 
locking an ammonia line had come 
up. If a section of line heats up and 
no relief valve is in the system in 
that area, the line could break and 
become permanently damaged. 
Agreements had to be put in place 
about how many minutes the sections 
of line could be closed off during 
parts of the orbital cycle when the 
line could heat up, and whether the 
crew members had to shade the line 
with the shadow of their body or 
bags. The valve choreography (i.e., 
opening and closing) during the EVA 
had to be perfectly timed between the 
crew and the ground. 

Tuesday, Dec 24,2013— 

The Second EVA (ISS EVA 25) 

The team prepped again, as they had 
for the first spacewalk. Everyone 
came to the Houston control center 
on the morning of Christmas Eve, 
determined to recover Loop A that 
day. The main tasks of the EVA 
would include retrieving the spare 
Pump Module from the External 
Stowage Platform-3 and moving it to 


the SI truss. The crew would install 
it, bolt it in, and connect it to Loop A. 
EVA preparations went smoothly. 

The crew depressed and egressed the 
airlock about 15 minutes early. 

On this spacewalk, Mastracchio 
would be the “free float” crew 
member. Hopkins would have the 
experience of riding on the arm and 
holding the Pump Module. Although 
one might imagine it as a relaxing 
ride, it is difficult to determine 
whether the boots are fully engaged 
in the foot restraint. This would be the 
first time Hopkins had been in a foot 
restraint on the tip of the 17-m (57-ft) 
robotic arm in space. He would have 
to indirectly feel that his boots were 
engaged, somewhat like a snow skier. 
However, the degree of difficulty 
was increased since he would not be 
able to see his boots due to spacesuit 
mobility, and because he would be 
holding a massive new Pump Module 
that would almost completely block 
his view, as seen in Figure 14. 


The crew prepared the new Pump 
Module and moved it robotically 
over to the SI truss installation, 
but the timeline was running about 
30 minutes behind schedule. Because 
of this, the flight controllers on the 
ground were discussing what could 
be done with the timeline while 
Hopkins was maneuvering the Pump 
Module. To avoid the need for a 
third spacewalk, the ammonia fluid 
QDs had to be mated to allow the 
ammonia to flow through the system 
after this EVA. However, the crew 
could not perform this task late in 
the EVA without running the risk of 
the suit getting contaminated with 
ammonia just before crew members 
come into the airlock at the end of 
the EVA, when their consumables 
would be near their limit. The flight 
control team made the decision to 
have them mate the fluid QDs before 
they mated the electrical cables—a 
change to the procedure that the crew 
was able to accommodate. 
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Some interesting and nail-biting 
moments occurred in space and 
in the Mission Control during this 
part of the EVA. First, one of the 
critical fluid QDs would not come 
free from its temporary location, 
thus it could not be connected to 
the new Pump Module. The button 
that needed to be pushed on the top 
of the QD could not be depressed. 


The crew and the ground team 
(Figure 15) worked together for 
quite some time on tool and other 
solutions, and eventually the QD 
came off. During the QD operations, 
some ammonia flakes came out, 
possibly causing suit contamination. 
However, when Mission Control 
sent a command to vent part of the 
system, a more-disturbing “cloud” of 


flakes surrounded both Hopkins and 
Mastracchio, clearly giving them both 
a good chance of having ammonia 
on their spacesuits. The vent was 
not expected to have this effect, and 
the surprise was not welcomed. The 
crew looked at the spacesuits and did 
not see visible ammonia ice crystals 
on the suits. The ground team later 
had the crew members perform a 


An Unexpected Walk in Space 

Colonel Michael Hopkins, Expedition 37/38 

December 11,2013, started out like most days on station. 
Rick [Mastracchio], Koichi [Wakata], Oleg [Kotov], Sergey 
[Ryazansky], Mikhail [Tyurin] and I woke up at our normal 
times, ate breakfast, drank coffee, cleaned up, and 
began executing the scheduled activities. Later that day, 
a warning alarm sounded, which brought us all floating 
to one of our Personal Computer System computers to 
determine what had gone wrong and what actions we 
needed to take as crew. However, before we even had 
a chance to open any corrective procedures, Mission 
Control Center-Houston called with a message: “We 
see the warning on the board, no action for the crew at 
this time.” This direction from the ground team was not 
unexpected because they are often able to correct failures 
from their work stations allowing those of us on-orbit 
to continue executing the planned science experiments 
and maintenance events. This teamwork between the 
astronauts and flight controllers is one of the strengths of 
ISS operations because the on-board crew can focus on 
those items that can only be accomplished by someone 
physically located with the equipment in space, and 
the true system experts—i.e. the flight controllers—can 
diagnose and often resolve ISS issues with little to no 
actions from the crew. 

My crewmates and I went back to the schedule and 
continued chasing the red line (the daily schedule uses 
a red line to indicate current time and astronauts try to 
complete their tasks before the red line crosses the 


activity). We did not have a full understanding of the scope 
of the problem, and we certainly did not understand the 
flurry of activity taking place on the ground. However, later 
in the day when Mission Control asked for assistance with 
some hardware power-down and cross-coupling activities, 
we knew this was not a run-of-the-mill malfunction that 
would be resolved by morning Daily Planning Conference 
(see Chapter 2). At some point over the next couple of 
days, we had a video conference with our lead flight 
director, Judd Frieling, and he explained the scope of the 
malfunction with the Pump Module of one of the external 
cooling loops, and the multiple options being considered 
by the ground teams, including the launch of Cygnus or a 
possible EVA solution. Now we did not have any scheduled 
EVAs as part of our increment, particularly with the 
ongoing investigation of water in the helmet. Therefore, any 
discussion of going out the door was very exciting while 
also highlighting the gravity of the situation. We informed 
the ground team that we were ready to support all of 
the options, that we were well rested, and that activities 
supporting both Cygnus capture and EVAs should be 
put on the schedule and task list. As a crew, we were 
determined to do what we could to keep all options on the 
table as long as possible. This started a 2-week period that 
was probably the most exciting time of Expedition 38, and 
was described by Rick, who had previously flown on the 
Space Shuttle three times, as a close representation of one 
of those 2-week missions. Over the next 10 days, there 
would be no days off, and work would often start before 
breakfast and continue well into the evening. 

During this time of uncertainty on the course of action, 
my crewmates and I often discussed the odds and made 
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“bake-out” (ammonia sublimation) 
outside the airlock (see Chapter 17). 

After the Pump Module was installed 
and all of the umbilicals were mated, 
the ground began checking it out by 
sending commands to fill the system. 
Before the EVA, one of the major 
discussion points was whether the 
team would spend time doing a short 


checkout of the Pump Module before 
filling it with ammonia. However, the 
EVA timeline was intertwined with 
the commands, and the EVA was 
running long. So, the flight director 
made the difficult decision to skip the 
checkout and starting filling the Pump 
Module full of ammonia instead, 
which saved EVA time but would 
mean a lot of ammonia would be 


wasted if the new pump did not work. 
The SPARTAN on console sent the 
appropriate commands to do so. 

The spacewalk ended with the team 
focused on a safe repress of the 
airlock. The crew performed a test in 
the airlock to see whether ammonia 
could be detected by passing airlock 
air though an ammonia-sensitive 


predictions on whether we were going to capture Cygnus 
in December or whether we were going to repair the 
Pump Module with several spacewalks. In fact, the night 
before Mission Control informed us of the decision to 
delay Cygnus and execute the EVAs, we had put Cygnus 
capture as the more likely option, given our reading of 
the tea leaves. Despite owing the bookie, we were happy 
to have a decision, and life on board station took on a 
new intensity level. Though I was trained and qualified 
to execute any EVA required, the final days before 
hatch open were less stressful because my two USOS 
crewmates, Rick and Koichi, were a veteran spacewalker 
and a veteran robotic arm operator, respectively. Their 
calm demeanor and methodical preparation gave 
everyone confidence that the team would be ready to 
execute the Pump Module remove and replace (R&R) in a 
few days’ time. 

On December 20, 2013, after 9 days of intense 
evaluations, meetings, decisions, and preparation, 
and 1 day before the first of three planned EVAs, the 
ground team was able to give us the afternoon off. 
Everyone was ready and it was time to relax. Then fate 
intervened with a little humor, and another problem 
occurred on the ISS. The separator fan for the toilet 
in the US Segment failed and a replacement unit would 
have to be installed before the bathroom was open for 
business again. However, the flight control team wanted 
to keep our schedule clear since the EVA was the next 
day and we could use the toilet in the Russian Segment. 
For Rick and me, the failure was a blessing because 
it gave us something to do rather than float around and 
think about the spacewalk. After a quick conference 


with the ground team, the flight director gave a go and 
we quickly had procedures on board to make the repair. 
So, the afternoon before one of the biggest days of 
our lives, Rick and I put on our plumber hats and repaired 
the space toilet. 

The Pump Module R&R in December 2013 showcased 
what happens when NASA goes into crisis mode. The 
preparations were superb, the procedures well written, 
the decisions spot on. With assistance from our Russian 
colleagues, Rick, Koichi and I followed the detailed 
instructions from Mission Control and completed 
the repairs in two instead of the three EVAs we were 
planning for totaling almost 13 hours outside station. 
Problems were encountered during the course of the 
R&R, but in all cases a solution was found. Staring out 
the airlock hatch at the vacuum of space before my first 
EVA was one of the most profound moments I’ve ever 
experienced, and climbing back into the airlock after the 
second EVA with words from Mission Control that the 
R&R was successful was one of the proudest moments 
I’ve ever had. NASA’s operation of the ISS provides daily 
reminders of the complexity of the job and the talent 
of the people assigned to the task. However, when a 
contingency happens, NASA takes it to another level and 
the accomplishments are truly amazing. For the crew of 
Expedition 38, the knowledge that the ground team put 
forward a super-human effort to solve the Pump Module 
failure drove us to do our small part with as much care 
and accuracy as possible, and together we had one of 
the best Christmas gifts ever. 
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Figure 15. The ISS flight controllers during the second spacewalk to repair the faulty Pump Module. From left to right: SPARTAN Flight Controller Bill 
Kowalczyk, the NASA videographer, CapcomsAki Hoshide and Doug Wheelock, Flight Director Dina Contella, BioMedical Engineer Lawrence Baitland, and 
Lead US EVA Officer Allison Bolinger, with John Mularski assisting. On the far right: Norman Knight, chief of the flight director’s office. 


substance that would turn from 
yellow to blue in the presence of 
ammonia. The test turned out to be 
negative—no ammonia was present. 
During repress of the airlock, 
Mastracchio’s communication cap 
lost audio in the right ear, giving the 
team even more to discuss. 

The EVA ended up lasting 7 hours 
and 29 minutes, about an hour 
longer than was planned, but with 
an incredibly successful installation 
of a new Pump Module. The 
degraded Pump Module was left out 
on the truss, where it could remain 
for several months (Figure 13). 


The ground team began activation 
of the new Pump Module and 
confirmed that it was working. The 
ground team told the crew of the 
successful results—the CAPCOM 
told them, “It’s the best Christmas 
ever!” Smiles and handshakes were 
exchanged among the proud and 
exhausted teammates. For many 
of those who had been working 
the EVAs, Christmas was certainly 
going to be a happy day off. 


Tuesday, Dec 25,2013, 
and Beyond 

A lot of work remained to be done 
to bring the entire loop back up to 
full functionality. The ammonia loop 
was at a lower pressure than nominal, 
and it would take quite some time 
to bring it back to normal pressure. 
Christmas was not a day of rest. 
Many intricate procedure details had 
been worked out in terms of adding 
nitrogen to part of the system to 
increase the pressure of the ammonia 
(see Chapter 11), and the issue 
with the Columbus heat exchanger 
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Figure 16. (Top) Flight Director Dina Contella leads the team in Mission Control during the repair of 
the Pump Module on Christmas Eve, 2013. The spacewalking astronauts are visible in the live video 
downlink on the left. (Bottom) Full view of the team controlling the spacewalk. 


cleared the way for the later Cygnus 
mission, which launched successfully 
on January 9, 2014, after the high 
beta cut-out. 

The lead Team 4 flight director 
summed up the teamwork that had 
occurred over the previous 2 weeks 
in this way: 

Throughout this huge team 
effort, I was incredibly 
impressed by those that I 
have worked with before 
and those that I hadn’t yet 
met. This was international 
spaceflight at its finest! 

Thank you! 

And so went the story of just one of 
many human spaceflight victories. 
For each person in Mission Control 
in December 2013, the victory was 
fought on a personal front. Sacrifices 
were made by so many personnel 
and their families, upending their 
daily schedules, weekends, and 
vacations. But there was a personal 
reward, as well—the satisfaction 
of knowing they worked a really 
difficult human spaceflight problem 
and saw it end in success! 


would need to be worked around 
by isolating it from the system until 
it could be exonerated from any 
damage. The loop actually had to be 
completely shut down at one point 
so the crew could remove an internal 


power jumper and reconfigure the 
power system. 

The team eventually managed to 
work through the details and bring the 
ISS back up to full functionality. This 
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Acronyms and Nomenclature 


A 

Approved 

AC 

Alternating Current 

ACE 

Atmosphere/Consumables Engineer 

ADCO 

Attitude Determination and Control Officer 

APAS 

Androgynous Peripheral Attachment System 

ARFTA 

Advanced Recycle Filter Tank Assembly 

ARO 

Automated Rendezvous Officer 

ATA 

Ammonia Tank Assembly 

ATCS 

Active Thermal Control System 

ATLAS 

Atmosphere Lighting Articulation Specialist 

atm 

atmosphere, standard 

ATM 

Toxic Atmosphere 

ATV 

Automated Transfer Vehicle 


Audio Terminal Unit 

AVENGER 

Assembly Video Engineer 

BC 

Bus Controller 

BCDU 

Battery Charge/Discharge Units 

BGA 

Beta Gimbal Assembly 

BME 

BioMedical Engineer 

C&C 

Command and Control 

C&DH 

Command and Data Handling 

C&T 

Communication and Tracking 

C&W 

Caution and Warning 

CAPCOM 

Capsule Communicator 

CATO 

Communications and Tracking Officer 

CBCS 

Centerline Berthing Camera System 

CBM 

Common Berthing Mechanism 

CCAA 

Common Cabin Air Assembly 

CCC 

Contaminant Control Cartridge 

CCPK 

Crew Contamination Protection Kit 

CCS 

Command and Control System 

CDM 

Carbon Dioxide Monitor 

CDRA 

Carbon Dioxide Removal Assembly 

CD-RW 

Compact Disk-Rewritable 

CIO 

Cargo Integration Officer 

cm 

centimeter 

CMG 

Control Moment Gyroscope 

CMS 

Chip Measurement System 

COLBERT 

Combined Operational Load Bearing External 
Resistance Treadmill 

COTS 

commercial off-the-shelf 


co 2 

carbon dioxide 

CRONUS 

Communications Radio Frequency Onboard 
Networks Utilization Specialist 

CRS 

Commercial Resupply Services 

CSA 

Canadian Space Agency 

CSA-CP 

Compound Specific Analyzer for 

Combustion Products 

CSG 

Columbus Support Group 

CTO 

Chief Training Officer 

CWC 

Contingency Water Container 

DAM 

debris avoidance maneuver 

DC 

Direct Current 


Docking Compartment 

DCS 

Decompression Sickness 

DCSU 

Direct Current Switching Unit 

DDCU 

DC-to-DC Converter Unit 

DJOPS 

Degraded Joint OPerationS 

DoD 

Department of Defense 

DPC 

Daily Planning Conference 

DVD-RW 

Digital Video Disc-Rewritable 

EBCS 

External Berthing Camera System 

ECLSS 

Environmental Control and Life Support System 

eDPC 

evening Daily Planning Conference 

EETCS 

Early External Thermal Control System 

ELC 

ExPRESS Logistics Carrier 

EMU 

Extravehicular Mobility Unit 

EPS 

Electrical Power System 

ESA 

European Space Agency 

ESP 

External Stowage Platform 

EST 

External Stowage Platform 

ETCS 

External Thermal Control System 

ETHOS 

Environmental and Thermal Operating Systems 

EV 

extravehicular 

EVA 

extravehicular activity 

express 

Expedite the Processing of Experiments 
to the Space Station 

EXT 

External 

FCR 

Flight Control Room 

FCT 

Flight Control Team 

FCV 

Flow Control Valve 

FDIR 

Failure Detection Isolation Recovery 

FGB 

Functional Cargo Block 
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FIR 

Fluids Integrated Rack 

ITCS 

Internal Thermal Control System 

FWD 

forward 

ITS 

Integrated Truss System 

Gb 

gigabyte 

IV 

intravehicular 

GC 

Ground Controller 

JAXA 

Japan Aerospace Exploration Agency 

GGR&C 

Generic Groundrules, Requirements, 

JEM 

Japanese Experiment Module 


and Constraints 

JEM-EF 

Japanese Experiment Module Exposed Facility 

GHz 

gigahertz 

JEM-PM 

Japanese Experiment Module -Pressurized Module 

GMT 

Greenwich Mean Time 

JEM-RMS 

Japanese Experiment Module Robotic Arm 

GNC 

Guidance, Navigation, and Control 

JOP 

Joint Operations Panel 

GPC 

General Purpose Computer 

JPM 

Japanese Pressurized Module 

GPS 

Global Positioning Satellite 

JSL 

Joint Station Local Area Network 

GPRV 

Gas Pressure Regulating Valve 

JSpOC 

Joint Space Operations Center 

Gr&C 

Groundrules and Constraints 

kbps 

kilobits per second 

GUI 

Graphical User Interface 

kg 

kilogram 

HCS 

Hub Control Software 

kN 

kilonewton 

HCZ 

Habitation Control Zone 

kPa 

kilopascals 

HDR 

high data rate 

kW 

kilowatt 

HEPA 

High Efficiency Particulate Air 

LAB 

Laboratory 

HGA 

high-gain antenna 

Lab C/0 

laboratory checkout 

HRS 

Heat Rejection Subsystem 

LAN 

Local Area Network 

HSG 

Houston Support Group 

LA-1 MDM 

US Lab 1 Multiplexer/Demultiplexer 

HTV 

H-II Transfer Vehicle 

lb 

pound 

h 2 

hydrogen 

LCA 

Loop Crossover Assembly 

h 2 o 

water 

LCD 

Liquid Crystal Display 

HX 

Heat Exchanger 

LCVG 

Liquid Cooling and Ventilation Garment 

IAC 

Internal Audio Controller 

LDR 

low data rate 

ICC 

Integrated Cargo Carrier 

LEE 

Latching End Effector 

IDRD 

Increment Definition and Requirements Document 

LEO 

low-Earth orbit 

IEPT 

International Execute Planning Team 

LiOH 

Lithium Hydroxide 

IFHX 

Interface Heat Exchanger 

LRP 

long-range planning 

IFM 

in-flight maintenance 


Long Range Planner 

IMMT 

International Space Station Mission 

Management Team 

LT 

Low Temperature 


LTA 

Launch-to-Activation 

IMV 

Intermodular Ventilation 



in. 

inch 

LTL 

Low Temperature Loop 

LVLH 

Local Vertical/Local Horizontal 

INT 

Internal 

MB 

megabyte 

10 

Information Only 

MBM 

Manual Berthing Mechanism 

I/O 

Input/Output 

MBS 

Mobile remote servicer Base System 

IP 

Internet Protocol 

MBSU 

Main Bus Switching Unit 

IR 

In Review 

Integration and Systems Engineer 

MCA 

Major Constituent Analyzer 

ISE 

MCC 

Mission Control Center 

ISO 

Integrated Stowage Officer 

Inventory Stowage Officer 

MCC-H 

Mission Control Center-Houston 

Mission Control Center-Moscow 


MCC-M 

ISS 

International Space Station 
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MCC-X 

SpaceX Mission Control Center 

PDAM 

Predetermined Debris Avoidance Maneuver 

MCS 

Motion Control System 

PDGF 

Power and Data Grapple Fixture 

MDM 

Multiplexer/DeMultiplexer 

PFCS 

Pump and Flow Control Subassembly 

MER 

Mission Evaluation Room 

PFE 

Portable Fire Extinguisher 

Metox 

metal oxide 

PHALCON 

Power, Heating, Articulation, Lighting Control 

MHz 

megahertz 

PL 

Payload 

MLI 

Multilayer Insulation 

PLSS 

Primary Life Support System 

MLM 

Multipurpose Laboratory Module 

PLUTO 

Plug-in-Plan and Utilization Officer 

MLS 

Mostly Liquid Separator 

PMA 

Pressurized Mating Adapter 

MMC 

Mission Control Center 

PMCU 

Power Module Control Unit 

mm Hg 

millimeters of mercury 

PMM 

Permanent Multipurpose Module 

MMOD 

Micrometeoroid and Orbital Debris 

POA 

Payload Orbital Replacement Unit 

MPEV 

Manual Pressure Equalization Valve 


Accommodations 

MPLM 

Multi-Purpose Logistics Module 

PPCR 

Planning Product Change Request 

MRM 

Mini Research Module 

PPL 

Pre-Positioned Load 

MSD 

Mass Storage Disk 

PPRA 

Positive Pressure Release Assembly 

MSS 

Mobile Servicing System 

ppm 

parts per million 

MT 

Moderate Temperature 

PPR 

Positive Pressure Relief 

MTL 

Moderate Temperature Loop 

PRO 

Power Resource Officer 

N1 

Node 1 

psi 

pounds per square inch 

n 2 

nitrogen 

PTCS 

Passive Thermal Control System 

NBL 

Neutral Buoyancy Laboratory 

PTR 

Port Thermal Radiator 

NCS 

Node Control System 

PV 

PhotoVoltaic 

NTA 

Nitrogen Tank Assembly 

PVCU 

PhotoVoltaic Control Unit 

o 2 

oxygen 

PVM 

Photo-Voltaic Modules 

03 

Orbit 3 

PVR 

PhotoVoltaic Radiator 

OBSS 

Orbiter Boom Sensor System 

PVTCS 

PhotoVoltaic Thermal Control System 

OCA 

Orbital Communications Adapter 

PWD 

Potable Water Dispenser 

OCM 

Orbital Conjunction Message 

QD 

Quick Disconnect 

ODIN 

Onboard Data Interfaces and Network 

R&R 

remove and replace 

OGA 

Oxygen Generation Assembly 

RAM 

Random Access Memory 

OOS 

On-orbit Operations Summary 

RAVEN 

Resource Avionics Engineer 

OPS PLAN 

Operations Planner 

RBI 

Remote Bus Isolator 

OPTIMIS 

Operations Planning TIMeline Integration System 

RIO 

Remote Interface Officer 

ORU 

Orbital Replacement Unit 

RF 

radio frequency 

OSO 

Operations Support Office 

RFG 

Radio Frequency Group 


Operations Support Officer 

RGA 

Rate Gyro Assembly 

OSTP 

Onboard Short Term Plan 

RM 

Redundancy Management 

OSTPV 

Onboard Short Term Plan Viewer 

ROBO 

Robotics Officer 

PAS 

Payload Attachment System 

ROS 

Russian Orbital Segment 

PBA 

Portable Breathing Apparatus 

Roscosmos 

Russian Federal Space Agency 

Pc 

probability of collision 

RPC 

Remote Power Controller 

PCA 

Pressure Control Assembly 

RPCM 

Remote Power Control Module 

PCS 

Portable Computer System 

RPE 

Resource Planning Engineer 
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rpm 

revolutions per minute 

RS 

Russian Segment 

RT 

Remote Terminal 

RTL 

Ready to Latch 

RWS 

Robotics Workstation 

SAFER 

Simplified Aid for EVA Rescue 

SARJ 

Solar Alpha Rotary Joint 

SAW 

Solar Array Wing 

SDS 

Sample Delivery System 

SIGI 

Space Integrated Global Positioning System/ 
Inertial Navigation System 

S/G 

Space-to-Ground 

SM 

Service Module 

SMCC 

Service Module Central Computer 

SMTC 

Service Module Terminal Computer 

SOC 

state of charge 

SOP 

Secondary Oxygen Package 

SPARTAN 

Station Power, ARticulation, Thermal, 
and ANalysis 

SPDM 

Special Purpose Dexterous Manipulator 

SPOC 

Station Power Operations Controller 

SRMS 

Shuttle Remote Manipulator System 

SSC 

Station Support Computer 

SSIPC 

Space Station Integration and Promotion Center 

SSG 

SSIPC Support Group 

SSMMU 

Solid State Mass Memory Unit 

SSN 

Space Surveillance Network 

SSRMS 

Space Station Remote Manipulator System 

SSU 

Sequential Shunt Unit 

STARCOM 

STAtion Radio frequency COMmunications 

STCR 

Starboard Thermal Control Radiator 

STP 

Short Term Plan 

STS 

Space Transportation System 

SVS 

Space Vision System 

TBA 

Trundle Bearing Assembly 

TBD 

To Be Determined 

TCA 

Thermal Control Radiator 
time of closest approach 

TCCS 

Trace Contaminant Control System 

TCON 

Thermal Control 

TCS 

Thermal Control System 

TDRS 

Tracking and Data Relay Satellite 

TEA 

Torque Equilibrium Attitude 

THC 

Temperature and Humidity Control 


THOR Thermal Operations and Resources 

TIG time of ignition 

TITAN Telemetry Information Transfer and 

Attitude Navigation 

TMG Thermal Micrometeoroid Garment 

TOPO Trajectory Operations Officer 

T-RAD Tile Repair Ablator Dispenser 

TRRJ Thermal Radiator Rotary Joint 

T2 Treadmill 2 

TTCR Trailing Thermal Control Radiator 

TWMV Three-Way Mixing Valve 

3-D three-dimensional 

UCCAS Unpressurized Cargo Common Attachment System 

UHF ultra-high frequency 

ULD Ultrasonic Leak Detector 

ULF Utilization Logistics Flight 

UMA Umbilical Mating Assembly 

UOP Utility Outlet Panel 

UPA Urine Processor Assembly 

USOS United States On-orbit Segment 

USTO USOS Thruster Only 

UTA utility transfer assembly 

UTC Coordinated Universal Time 

H,BM Russian Segment Central Computers 

V volt 

VES Vacuum Exhaust System 

VRA Vent and Release Assembly 

VRS Vacuum Resource System 

VVA Visiting Vehicles Officer 

VV DYN Visiting Vehicle Dynamics 

WHC Waste and Hygiene Compartment 

WIF Worksite Interface 

WLP Weekly Lookahead Plan 

WPA Water Processor Assembly 

XPOP X-Perpendicular Out of Plane 

YPR Yaw, Pitch, and Roll 
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